# list_dependabot_alerts

A read tool on the GitHub MCP server.

Agent View of the PolicyLayer registry record for `list_dependabot_alerts`. HTML page: https://policylayer.com/tools/io-github-aifity-omnigit-mcp/list-dependabot-alerts

## Facts

- Tool: `list_dependabot_alerts`
- Server: GitHub (`oci:ghcr.io/aifity/omnigit-mcp:0.5.0`) — https://policylayer.com/tools/io-github-aifity-omnigit-mcp.md
- Homepage: https://github.com/aifity/omnigit-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_dependabot_alerts",
    "arguments": {}
  }
}
```

## Why list_dependabot_alerts is rated Low

This tool queries existing Dependabot security alerts in a repository. It performs information retrieval with no side effects, no modifications to data, and no execution of code or workflows. The blast radius of misuse is minimal—an unauthorized user could view vulnerability information about project dependencies, which is a read-level information disclosure risk, not a destructive or execute-level risk.

From the tool's own definition: "The tool name 'list_dependabot_alerts' and description 'List dependabot alerts' indicate a read-only operation that retrieves security alert data without modifying, deleting, or executing anything."

## Use case

AI agents call list_dependabot_alerts to retrieve information from GitHub without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches GitHub:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_dependabot_alerts": {}
  }
}
```

## Other tools on GitHub (244)

- `delete_file` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/delete-file.md
- `force` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/force.md
- `git_reset` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-reset.md
- `git_worktree_prune` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-prune.md
- `git_worktree_remove` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-remove.md
- `actions_run_trigger` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/actions-run-trigger.md
- `detach` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/detach.md
- `git_checkout` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-checkout.md
- `git_pull` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-pull.md
- `git_push` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-push.md
- `git_worktree_add` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-add.md
- `git_worktree_lock` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-lock.md
- `autoInit` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/autoinit.md
- `base` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/base.md
- `base_branch` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/base-branch.md
- `base_ref` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/base-ref.md
- `before_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/before-id.md
- `branch` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/branch.md
- `branch_name` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/branch-name.md
- `color` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/color.md
- `comment_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/comment-id.md
- `commentId` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/commentid.md
- `commit_title` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/commit-title.md
- `commitID` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/commitid.md
- `direction` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/direction.md
- `gist_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/gist-id.md
- `issue_number` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/issue-number.md
- `item_type` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/item-type.md
- `job_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/job-id.md
- `message` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/message.md
- …and 214 more: https://policylayer.com/tools/io-github-aifity-omnigit-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-aifity-omnigit-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-aifity-omnigit-mcp