Security Scanning Features
Relevant source files
The following files were used as context for generating this wiki page:
The Security Scanning Features within the GitHub MCP Server provide a programmatic interface to GitHub's native security tools, including Code Scanning, Secret Scanning, and Security Advisories. These features allow Model Context Protocol (MCP) clients to query security vulnerabilities, track alert states, and access global or repository-specific advisory databases.
These capabilities are grouped into specific toolsets such as code_security and secret_protection, enabling automated agents to perform security audits and maintain the integrity of repositories.
Sources: cmd/github-mcp-server/generate_docs.go:193-196, SECURITY.md:3-5
Code Scanning Alerts
Code scanning features allow for the retrieval and listing of security alerts generated by static analysis tools (like CodeQL) integrated into GitHub repositories. The system supports fetching specific alert details or filtering lists based on state, severity, and the tool used.
Alert Management Logic
The implementation follows a standard request-response pattern where the MCP server interacts with the GitHub REST API. Users can query alerts for a specific owner and repo, with optional parameters to narrow down findings.
The diagram above shows the logic flow for retrieving code scanning data from the GitHub API.
Sources: pkg/github/code_scanning_test.go:21-30, pkg/github/code_scanning_test.go:110-120
Key Functions and Parameters
The following table summarizes the primary tools available for managing code scanning alerts:
| Tool Name | Description | Required Parameters | Optional Filters |
|---|---|---|---|
get_code_scanning_alert | Get a specific alert by number | owner, repo, alertNumber | N/A |
list_code_scanning_alerts | List alerts for a repository | owner, repo | ref, state, severity, tool_name |
Sources: pkg/github/code_scanning_test.go:28-32, pkg/github/code_scanning_test.go:114-122
Security Advisories
The system provides extensive tools to query the GitHub Advisory Database. This includes global advisories affecting ecosystems (like npm or PyPI) and specific advisories private to an organization or repository.
Advisory Hierarchy
The architecture distinguishes between Global Security Advisories (public) and Repository Security Advisories (often private/in-triage).
Visual representation of the scopes available for security advisory retrieval.
Sources: pkg/github/security_advisories_test.go:20-25, pkg/github/security_advisories_test.go:167-175, pkg/github/security_advisories_test.go:265-272
Security Advisory Toolset Details
Security advisories use specific identifiers (GHSA IDs) for direct retrieval.
| Function | Scope | Key Parameters |
|---|---|---|
ListGlobalSecurityAdvisories | Global | ecosystem, severity, ghsaId |
GetGlobalSecurityAdvisory | Global | ghsaId (Required) |
ListRepositorySecurityAdvisories | Repository | owner, repo, state, sort |
ListOrgRepositorySecurityAdvisories | Organization | org, state, direction |
Sources: pkg/github/security_advisories_test.go:23-26, pkg/github/security_advisories_test.go:102-105, pkg/github/security_advisories_test.go:170-176
Implementation Patterns
The security features utilize standardized MCP result structures. For instance, when an alert is fetched, the server converts the GitHub github.Alert object into a JSON string within an mcp.NewToolResultText.
Error Handling
If an API call fails (e.g., a 404 Not Found), the server generates a structured error response.
// Example of error handling pattern in security tools
if err != nil {
return ghErrors.NewGitHubAPIErrorResponse(ctx,
"failed to get alert",
resp,
err,
), nil
}
Sources: pkg/github/code_scanning_test.go:73-80, pkg/github/repositories.go:76-81
Conclusion
Security Scanning Features provide a critical layer of automation for identifying vulnerabilities and managing disclosures. By exposing GitHub's Security Advisories and Code Scanning APIs through the MCP protocol, the server enables agents to maintain a "security-first" posture during the development lifecycle.
Sources: SECURITY.md:3-8, cmd/github-mcp-server/generate_docs.go:167-175