github / github/github-mcp-server

Feature Request: Add support for GitHub Security APIs (Dependabot, Code Scanning, Secret Scanning)

Offen
#1,921 7 Kommentare 3 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Go
Sterne
33k
Forks
5k
Ø Merge
2 T. 1 Std.
Gemergte PRs (30 T.)
52

Beschreibung

## Summary

The MCP server currently lacks tools to interact with GitHub's security features. Adding support for the Security APIs would enable AI agents to help users identify, triage, and remediate security vulnerabilities in their repositories.

## Use Case

When a user asks an AI agent to "fix the issues in the security tab" of a repository, the agent currently cannot:

1. **List security alerts** - No way to retrieve Dependabot alerts, Code Scanning alerts, or Secret Scanning alerts
2. **View alert details** - Cannot get specifics about a vulnerability (CVE, severity, affected package/file, remediation guidance)
3. **Dismiss or resolve alerts** - Cannot mark alerts as fixed, dismissed, or false positives
4. **Update vulnerable dependencies** - While file editing is possible, understanding what needs to change requires alert data

## Requested Tools

### Dependabot Alerts
- `list_dependabot_alerts` - List Dependabot alerts for a repository
- `get_dependabot_alert` - Get details of a specific Dependabot alert
- `update_dependabot_alert` - Dismiss or reopen a Dependabot alert

### Code Scanning (CodeQL)
- `list_code_scanning_alerts` - List code scanning alerts for a repository
- `get_code_scanning_alert` - Get details of a specific code scanning alert
- `update_code_scanning_alert` - Dismiss or reopen a code scanning alert

### Secret Scanning
- `list_secret_scanning_alerts` - List secret scanning alerts for a repository
- `get_secret_scanning_alert` - Get details of a specific secret scanning alert
- `update_secret_scanning_alert` - Update the state of a secret scanning alert (resolve, reopen, etc.)

## API References

- [Dependabot Alerts API](https://docs.github.com/en/rest/dependabot/alerts)
- [Code Scanning API](https://docs.github.com/en/rest/code-scanning/code-scanning)
- [Secret Scanning API](https://docs.github.com/en/rest/secret-scanning/secret-scanning)

## Impact

These tools would enable AI agents to:
- Automatically identify and fix vulnerable dependencies by updating Gemfile, package.json, etc.
- Review and help remediate code scanning findings
- Assist with secret rotation workflows when credentials are exposed
- Provide security posture summaries for repositories

Thank you for considering this enhancement!

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by reading the linked Dependabot Alerts, Code Scanning, and Secret Scanning API references, then inspect the MCP server's existing tool entry points and conventions. Done means implementing the nine requested list, get, and update tools with the alert details and state changes described in the issue.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
github, go
Bereich
api, security
Issue-Typ
Feature
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
45/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.