Secrets
CheckedThe latest scan completed this check. It does not guarantee full coverage of the repository.
MCP servers · Security report
Alerts to reviewgithub/github-mcp-serverIs github-mcp-server safe to use?
Short answer
No scan can prove a project is safe. Our latest scan of github-mcp-server flagged 8 automated alerts, all classified as Secrets, and 1 of them are high or critical. Review them before you run github-mcp-server with real data or credentials.
- Automated alerts
- 8
- High or critical
- 1
- Most flagged
- Secrets
- Last scanned
GitHub's official MCP Server
The assessment, at a glance
All 8 automated alerts are classified as Secrets
100% of the alerts in the current repository snapshot are classified as Secrets. 1 of all alerts are critical or high severity. Categories and severity are triage signals; these alerts have not been independently validated as vulnerabilities.
Repository snapshot from Plexicus staging. Counts may include earlier scans and are not attributed to an exact run or commit. Check categories come from the latest observed job and can differ from the scans contributing findings. Completed categories describe bundle delivery, not full repository coverage.
What we found
What the scan flagged
Alerts are leads for review, sorted by type and severity. They are not confirmed vulnerabilities.
Alerts by type
- Secrets100% of alerts
- 8
Types describe all current alerts for this repository, not only the latest scan.
Repository findings snapshot
Current repository findings
8automated alerts
Findings currently visible in the Plexicus repository record. These alerts have not been validated as vulnerabilities or attributed to this exact scan or commit.
- Critical
- 0
- High
- 1
- Medium
- 7
- Low
- 0
- Informational
- 0
Source: Plexicus staging · Collected
Scope and counting limits
These are current repository totals, which may include findings from earlier scans. Scan-specific counts and the scanned commit remain unverified. The snapshot excludes findings marked as false positives, duplicates, deleted, or sandbox results, and findings still awaiting processing or enrichment.
Next steps
How to use github-mcp-server more safely
Practical steps based on what the scan flagged. They are general guidance, not confirmation of an exploitable vulnerability.
Review the 1 critical or high severity alerts first; confirm validity and impact before remediation.
Confirm false positives and duplicate root causes before using alert totals to prioritize work.
Secrets (8): validate suspected secrets privately. Revoke or rotate credentials only when exposure is confirmed, and never publish secret values.
Try it in a container or virtual machine first, with throwaway credentials.
Pin a specific release or commit instead of tracking the latest code.
This public report shows totals only. File names, exploitability, and false-positive rates are not included.
What we checked
Which checks ran?
Each card shows whether the latest scan completed that type of check. A completed check does not mean every file or rule was covered.
Code security
Not checkedDo not assume this area was assessed.
Dependencies
Not checkedDo not assume this area was assessed.
Configuration
Not checkedDo not assume this area was assessed.
Limits
What this report cannot tell you
- Alert totals can include results from earlier scans and are not tied to one exact commit.
- Automated alerts need investigation. Severity is a scanner's estimate, not a confirmed impact.
- Zero alerts means nothing was flagged in the checks that ran, not that the project is safe.
- Runtime behavior, deployment settings, MCP permissions, and prompt injection are not assessed unless listed above.
Technical scan record & repository metadata
- Platform execution
- Platform job completed
- Commit evidence
- Scanned commit not verified
- Last checked (UTC)
- 2026-10-16T05:03:37.349Z
- Default branch
- main
Result bundles: 1 of 1 complete; 0 failed; 0 degraded. Bundle completion alone does not establish full scan coverage.
Requested commit e3809fe91c7546633241006bf0b91f23b2595e28
Scan source fork: View fork ↗
Repository metadata retrieved 2026-10-15T08:13:45.762Z. Candidate commit from metadata: c59e8c199efbf14467211861de44afaeeb6873e3. A candidate commit is not proof of the scanned commit.
Questions about github-mcp-server
Is github-mcp-server safe to use?
No scan can prove a project is safe. Our latest scan of github-mcp-server flagged 8 automated alerts, all classified as Secrets, and 1 of them are high or critical. Review them before you run github-mcp-server with real data or credentials.
What did Plexicus find in github-mcp-server?
100% of the alerts in the current repository snapshot are classified as Secrets. 1 of all alerts are critical or high severity. Categories and severity are triage signals; these alerts have not been independently validated as vulnerabilities.
What did the scan not check?
Runtime behavior, deployment settings, MCP and tool permissions, and prompt injection are not covered unless listed in the checks above. Review those before giving the tool access to real data.
How can I check my own fork or project?
Scan it with the free Plexicus SAST tool. Connect GitHub and get a report for your own repository.
For maintainers
Add the github-mcp-server security report to your README
Show users where to find this report. The badge links to this page and makes no safety claim.
[](https://www.plexicus.ai/open-source/github/github-mcp-server/)Your own code
Scan your own repository for free.
Connect GitHub and see what Plexicus flags in your code.
Scan your repository free ↗