github_check_token_scopes

What github_check_token_scopes does on Github

AI agents call github_check_token_scopes to retrieve information from Github without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why github_check_token_scopes is rated Low

This tool performs a passive inspection of token capabilities. It retrieves information about what scopes a GitHub token possesses, which is a read operation with no side effects. It does not modify, execute, create, delete, or move any data or resources. The blast radius is minimal—misuse would only surface token capability information that the holder already implicitly possesses.

From the tool's definition Tool name 'github_check_token_scopes' and description 'Check whether the current token has the required (classic) scopes' indicate a read-only inspection operation that queries token metadata without modifying anything.

The rule that runs github_check_token_scopes safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Github, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For github_check_token_scopes, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "github_check_token_scopes": {}
  }
}

Questions about github_check_token_scopes