# issue_write

Create a new or update an existing issue in a GitHub repository.

Agent View of the PolicyLayer registry record for `issue_write`. HTML page: https://policylayer.com/tools/github/issue-write

## Facts

- Tool: `issue_write`
- Server: GitHub (`oci:ghcr.io/github/github-mcp-server:1.3.0`) — https://policylayer.com/tools/github.md
- Homepage: https://github.com/github/github-mcp-server
- Risk category: Write (Medium risk)
- Registry record: grade D, identity verified
- Server auth posture: gated
- Server rate-limited: no
- Parameters: 12
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `body` | string | no | Issue body content |
| `repo` | string | no | Repository name |
| `type` | string | no | Type of this issue. Only use if the repository has issue types configured. Use list_issue_types tool to get valid type values for the organization. If the repos |
| `owner` | string | no | Repository owner |
| `state` | string | no | New state |
| `title` | string | no | Issue title |
| `labels` | array | no | Labels to apply to this issue |
| `method` | string | no | Write operation to perform on a single issue. Options are: - 'create' - creates a new issue. - 'update' - updates an existing issue. |
| `assignees` | array | no | Usernames to assign to this issue |
| `milestone` | number | no | Milestone number |
| `duplicate_of` | number | no | Issue number that this issue is a duplicate of. Only used when state_reason is 'duplicate'. |
| `issue_number` | number | no | Issue number to update |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "issue_write",
    "arguments": {}
  }
}
```

## Why issue_write is rated Medium

This tool creates or modifies GitHub issues, which are reversible operations. It does not delete data (Destructive), execute arbitrary code (Execute), or move money (Financial). The blast radius is medium because malicious use could spam repositories, modify issue tracking data, or disrupt project workflows, but the effects are reversible through issue deletion or editing.

From the tool's own definition: "Tool name 'issue_write' and description 'Create a new or update an existing issue in a GitHub repository' explicitly indicate creation and modification of data."

Risk signals: Accepts raw HTML/template content (body) · High parameter count (13 properties)

## Use case

AI agents use issue_write to create or update resources in GitHub, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your GitHub environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches GitHub:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "issue_write": {
      "limits": [
        {
          "counter": "issue_write_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on GitHub (85)

- `delete_file` — Destructive — https://policylayer.com/tools/github/delete-file.md
- `projects_write` — Destructive — https://policylayer.com/tools/github/projects-write.md
- `actions_run_trigger` — Execute — https://policylayer.com/tools/github/actions-run-trigger.md
- `assign_copilot_to_issue` — Execute — https://policylayer.com/tools/github/assign-copilot-to-issue.md
- `actions_get` — Read — https://policylayer.com/tools/github/actions-get.md
- `actions_list` — Read — https://policylayer.com/tools/github/actions-list.md
- `get_code_scanning_alert` — Read — https://policylayer.com/tools/github/get-code-scanning-alert.md
- `get_commit` — Read — https://policylayer.com/tools/github/get-commit.md
- `get_copilot_job_status` — Read — https://policylayer.com/tools/github/get-copilot-job-status.md
- `get_copilot_space` — Read — https://policylayer.com/tools/github/get-copilot-space.md
- `get_dependabot_alert` — Read — https://policylayer.com/tools/github/get-dependabot-alert.md
- `get_discussion` — Read — https://policylayer.com/tools/github/get-discussion.md
- `get_discussion_comments` — Read — https://policylayer.com/tools/github/get-discussion-comments.md
- `get_file_contents` — Read — https://policylayer.com/tools/github/get-file-contents.md
- `get_gist` — Read — https://policylayer.com/tools/github/get-gist.md
- `get_global_security_advisory` — Read — https://policylayer.com/tools/github/get-global-security-advisory.md
- `get_job_logs` — Read — https://policylayer.com/tools/github/get-job-logs.md
- `get_label` — Read — https://policylayer.com/tools/github/get-label.md
- `get_latest_release` — Read — https://policylayer.com/tools/github/get-latest-release.md
- `get_me` — Read — https://policylayer.com/tools/github/get-me.md
- `get_notification_details` — Read — https://policylayer.com/tools/github/get-notification-details.md
- `get_release_by_tag` — Read — https://policylayer.com/tools/github/get-release-by-tag.md
- `get_repository_tree` — Read — https://policylayer.com/tools/github/get-repository-tree.md
- `get_secret_scanning_alert` — Read — https://policylayer.com/tools/github/get-secret-scanning-alert.md
- `get_tag` — Read — https://policylayer.com/tools/github/get-tag.md
- `get_team_members` — Read — https://policylayer.com/tools/github/get-team-members.md
- `get_teams` — Read — https://policylayer.com/tools/github/get-teams.md
- `github_support_docs_search` — Read — https://policylayer.com/tools/github/github-support-docs-search.md
- `issue_read` — Read — https://policylayer.com/tools/github/issue-read.md
- `list_branches` — Read — https://policylayer.com/tools/github/list-branches.md
- …and 55 more: https://policylayer.com/tools/github.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=github · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/github