# audit_github

Audit a GitHub repo for security signals (open CVEs in deps, last commit age, license, contributor count). Pass owner/repo. Use for OSS supply-chain risk scoring. Example call: {"owner_repo": "vercel/next.js"} Cost: $0.005–$0.05 USDC on Base per call.

Agent View of the PolicyLayer registry record for `audit_github`. HTML page: https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/audit-github

## Facts

- Tool: `audit_github`
- Server: GoCreative Agent API (`https://api.gocreativeai.com/mcp`) — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api.md
- Homepage: https://github.com/https://api.gocreativeai.com/mcp
- Risk category: Read (Low risk)
- Registry record: grade D, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 1 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `owner_repo` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "audit_github",
    "arguments": {
      "owner_repo": "<owner_repo>"
    }
  }
}
```

## Why audit_github is rated Low

This tool performs read-only queries of publicly available or authorized GitHub repository metadata. It gathers intelligence about security signals but does not create, modify, delete, execute code, move funds, or trigger external operations.

From the tool's own definition: "The tool 'audit_github' retrieves and queries security metadata about a GitHub repository: 'open CVEs in deps, last commit age, license, contributor count.' The call signature shows it accepts owner/repo as input parameters and returns audit information with…"

## Use case

AI agents call audit_github to retrieve information from GoCreative Agent API without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches GoCreative Agent API:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "audit_github": {}
  }
}
```

## Other tools on GoCreative Agent API (171)

- `ai_ask` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/ai-ask.md
- `enrich_browserbase` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/enrich-browserbase.md
- `lookup_credit_card_validate` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/lookup-credit-card-validate.md
- `lookup_lighthouse` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/lookup-lighthouse.md
- `lookup_qr_code` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/lookup-qr-code.md
- `lookup_uuid` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/lookup-uuid.md
- `scrape_firefoxstore` — Financial — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/scrape-firefoxstore.md
- `ai_pro` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/ai-pro.md
- `ai_ultra` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/ai-ultra.md
- `bundle_company_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-company-360.md
- `bundle_crypto_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-crypto-360.md
- `bundle_dev_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-dev-360.md
- `bundle_device_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-device-360.md
- `bundle_diligence_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-diligence-360.md
- `bundle_domain_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-domain-360.md
- `bundle_drug_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-drug-360.md
- `bundle_email_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-email-360.md
- `bundle_kyb_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-kyb-360.md
- `bundle_regulatory_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-regulatory-360.md
- `bundle_repo_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-repo-360.md
- `bundle_risk_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-risk-360.md
- `bundle_sales_intent` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-sales-intent.md
- `bundle_sec_360` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/bundle-sec-360.md
- `data_clinical_trials` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/data-clinical-trials.md
- `data_ip_threat` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/data-ip-threat.md
- `data_sanctions_screen` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/data-sanctions-screen.md
- `enrich_apify` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/enrich-apify.md
- `enrich_browsersnap` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/enrich-browsersnap.md
- `enrich_company` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/enrich-company.md
- `enrich_github` — Read — https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api/enrich-github.md
- …and 141 more: https://policylayer.com/tools/io-github-colinhughes2121-gocreative-agent-api.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-colinhughes2121-gocreative-agent-api · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-colinhughes2121-gocreative-agent-api