MCP field guide / GitHub
// mcp field guide · devops
GitHub's official server hands an agent the keys to your repos, issues, PRs, Actions and security data. Most of that is safe reads — but a few tools merge to main, trigger deploys, or post publicly, and those don't cleanly undo. Here's the sourced map of what's dangerous and what isn't.
GUARD FIT · READ SURFACE (majority)
PASS-THROUGHSearch/list/read across repos, issues, PRs and security alerts. No side effects — and GitHub's own read-only mode already covers the coarse case.
GUARD FIT · HIGH-BLAST-RADIUS WRITES
STRONGMerging to main, pushing to prod repos, triggering a deploy workflow, posting public comments — the guard's value is gating this subset, finer than all-or-nothing read-only.
Overall fit: STRONG (calibrated) — a near-textbook target because its surface is cleanly bimodal.
The canonical one is github/github-mcp-server — GitHub's own official server (written in Go, built with Anthropic). It runs locally (Docker or a native binary) or as a GitHub-hosted remote. Tools are organized into ~20 toolsets you can selectively enable; the defaults are context, issues, pull_requests, repos, users.13 The older @modelcontextprotocol/server-github reference package was archived on 2025-05-29 and its README redirects to the official server — treat it as historical.4
Naming moves fast: GitHub consolidated several tools in late 2025 (e.g. create_issue/get_issue → issue_write/issue_read; PR reads → pull_request_read). Names below are from the current main README as of Aug 2026 — always check the source link.
| Tool (examples) | Risk | Why |
|---|---|---|
| get_file_contents, search_code, list_commits, issue_read, pull_request_read, list_*_alerts | read-only | Search/list/read across repos, issues, PRs, Actions, security. No side effects. |
| create_or_update_file, push_files, create_branch, create_repository, fork_repository | mutating | Writes commits/branches/repos. Recoverable in git history, but real state changes. |
| issue_write, add_issue_comment, create_pull_request, update_pull_request | mutating | Create/update issues and PRs. Fire notifications; publicly visible. |
| merge_pull_request | irreversible-ish | Merges into the target branch. Once others pull, a revert is a new commit, not erasure. Highest blast radius on main. |
| actions_run_trigger | irreversible-ish | Runs a workflow — a deploy/release can cause real external, irreversible effects. |
| delete_file | mutating | Removes a file via a commit (recoverable from history, but a state change). |
| public comments / review submissions | irreversible-ish | The notification/webhook fires and subscribers see it before any deletion. Effectively un-recallable. |
Accuracy note (it cuts both ways): the server does ship delete_file (removes a file via a commit — recoverable from git history, but a real delete), and the label_write / discussion_comment_write tools expose delete methods too. What it does not expose is delete_branch or delete_repository — so the "nuke the whole repo" scenario some assume isn't in the documented toolset, but "it can't delete anything" would be equally wrong.1
Triage-to-fix loop. Read a failing Actions run (get_job_logs), search the code, open a branch and commit a fix, open a PR for human review.
Issue / project hygiene. Search and read issues, label/update them, post a summary comment.
Security review assistant. Enumerate code-scanning / Dependabot / secret-scanning alerts and draft a remediation PR — read-heavy, one gated write at the end.
GitHub already ships a read-only mode (a flag/env-var/header that disables every non-read tool, taking precedence over other config) plus a lockdown mode for content exfiltration.2 So for a purely read-only agent, an external guard adds little. The guard's real, differentiated value is allowing writes but gating the dangerous subset — finer than GitHub's all-or-nothing switch:
merge_pull_request — the strongest case. A pre-merge human diff is exactly "impact diff → approve," and merging to a protected branch is effectively irreversible once pulled.push_files, create_or_update_file, delete_file) — recoverable in history, but worth a checkpoint on shared branches.actions_run_trigger — can launch a deploy with irreversible external effects; a checkpoint here prevents an irreversible production action.Honest framing: several of these are not truly reversible, so the correct posture is "this merge/comment cannot be un-sent, only followed by a corrective action" — compensation, not undo. The guard's differentiation vs. GitHub's own toggles is granular per-tool gating plus honest irreversibility reporting and a tamper-evident record of who approved the merge.
Let an agent read and draft freely; require a human before it merges to main, triggers a deploy, or posts in public.
Read the quickstart → More MCP profilesProfiles describe third-party software from its public sources; ChronoMCP is not affiliated with these projects. Tool names/capabilities reflect the current main as of Aug 2026 and change often — check the source links for the latest.