Skip to main content
Glama

20 Best GitHub MCP Servers, Compared (September 2026)

Updated 20 of 1,639 GitHub servers in the Glama registryRebuilt weekly

The short answer

Use the GitHub MCP Server (github/github-mcp-server) unless your task is narrow. It is GitHub's official MCP server, is labelled Community favourite, and is active: it had a commit 6 days ago and 200 commits in the last 12 weeks. That covers the common needs of repository browsing, issue and PR automation, and Actions workflow monitoring. If your task is strictly to pull specific functions or classes out of a large repository while keeping token use low, github-codemunch-mcp is the better answer: it had a commit 0 days ago and 1,010 commits in the last 12 weeks.

Whichever you choose, give it the narrowest access that still works (a read-only credential, a replica, a scratch account), and widen it only once you have watched what your agent actually asks for.

Glama operates the MCP registry these numbers are measured from, and sells MCP hosting and a gateway. No position on this page is paid for. How the registry is built.

Quick picks

  • 1GitHub MCP Server : Teams that want GitHub's own MCP server for AI assistants: it documents repository browsing, issue and PR automation, and Actions workflow monitoring.`n`n`
  • 2github-codemunch-mcp : For exploring large GitHub repositories and retrieving only the specific functions or classes you need, its tree-sitter AST indexing enables precise symbol search and extraction.
  • 3Octocode MCP : Developers researching unfamiliar codebases across local files, GitHub, and npm: it combines local ripgrep/LSP tools with GitHub and package search.
  • 4idea-reality-mcp : Before starting a new project: it exposes idea_check, which scans GitHub, Hacker News, npm, PyPI and Stack Overflow for existing competition.
  • 5mcp-github-project-manager : AI coding agents that need a persistent coordination layer on GitHub Projects v2: it provides task checkout, atomic claims, heartbeat monitoring, and token budgets.

Which one, for your situation

Your situationWhat to use
I need an official maintained server for repository and PR workUse the GitHub MCP Server (github/github-mcp-server): it is GitHub's official server, had a commit 6 days ago, and has 200 commits in the last 12 weeks.
Large repo, I need only specific functions or classes with low tokensUse github-codemunch-mcp: it uses tree-sitter AST for symbol extraction, exposes 7 tools, and had a commit 0 days ago and 1,010 commits in the last 12 weeks.
I manage GitHub Projects v2 boards, sprints, and tasksUse mcp-github-project-manager: it is built for GitHub Projects v2 workflows and exposes 84 tools.
I need a one-command GitHub org and repository security auditUse github-security-mcp: it has 39 tools for GitHub security audits, but it is labelled Abandoned but popular, with a last commit 184 days ago and 0 commits in the last 12 weeks.
Detect duplicate code before I commit a snippetUse jscpd: its MCP server can check a snippet against a scanned project, exposes 4 tools, and had a commit 0 days ago and 370 commits in the last 12 weeks.
Wrap my existing MCP server in a security proxyUse pipelock: it wraps any MCP server with bidirectional scanning for credential leaks, prompt injection, and tool description poisoning, and had a commit 0 days ago and 700 commits in the last 12 weeks.

Top MCP servers for GitHub

Best forProfile
1
github/github-mcp-server
Teams that want GitHub's own MCP server for AI assistants: it documents repository browsing, issue and PR automation, and Actions workflow monitoring.`n`n`Community favourite32,846+6806 days ago92.3
2
jgravelle/jcodemunch-mcp
For exploring large GitHub repositories and retrieving only the specific functions or classes you need, its tree-sitter AST indexing enables precise symbol search and extraction.Community favourite2,684+123today82.8
3
bgauryy/octocode
Developers researching unfamiliar codebases across local files, GitHub, and npm: it combines local ripgrep/LSP tools with GitHub and package search.Community favourite932+2120 days ago66.5
4
mnemox-ai/idea-reality-mcp
Before starting a new project: it exposes idea_check, which scans GitHub, Hacker News, npm, PyPI and Stack Overflow for existing competition.Community favourite815+3634 days ago64.7
5
kunwarVivek/mcp-github-project-manager
AI coding agents that need a persistent coordination layer on GitHub Projects v2: it provides task checkout, atomic claims, heartbeat monitoring, and token budgets.Steady97+46 days ago63.6
6
Shelpuk-AI-Technology-Consulting/kindly-web-search-mcp-server
Debugging a coding problem that needs StackOverflow, GitHub Issues, arXiv, or Wikipedia content: it returns the full conversation in one call.Community favourite385+143 days ago59.2
7
idosal/git-mcp
Developers using AI assistants like Cursor with niche or recently changed GitHub projects: it exposes up-to-date repository docs and code through a URL-based MCP endpoint.Abandoned but popular8,376+57129 days ago55.7
8
yusufkaraaslan/Skill_Seekers
When you need to convert docs, GitHub repos, PDFs, videos, and codebases into AI-ready skills from Claude Code, it exposes scraping, packaging, and upload tools.Community favourite14,963+208yesterday54.7
9
badchars/cve-mcp
Incident response and dependency audits: it exposes 41 tools that pull CVE, exploit, and package-impact data from 11 vulnerability sources through one MCP server.Community favourite27+870 days ago54.4
10
miantiao-me/github-stars
Finding a previously starred repository from a description: it indexes the READMEs of a user's starred repositories and provides natural-language search.Steady113+12 days ago54.1
11
badchars/github-security-mcp
AI agents that need a one-command GitHub org and repo security audit: it exposes a tool that runs all 45 checks and aggregates findings.Abandoned but popular120184 days ago52.6
12
kucherenko/jscpd
Before writing or committing a block: check_duplication tests a snippet against the scanned project.Community favourite6,193No snapshot historytoday50.4
13
luckyPipewrench/pipelock
Wrapping an existing MCP server in a security boundary: it scans both directions for credential leaks, prompt injection, and tool description poisoning.Community favourite842+51today49.7
14
asklokesh/loki-mode
From a written spec to a verified product build: it runs autonomously and exposes MCP tools for task queue, code search, and verification reports.Community favourite1,057+16today48.8
15
duriantaco/skylos
Pre-merge review of AI-generated code: it exposes static-analysis tools such as security_scan and validate_code_change for dead code, secrets, and quality issues.Community favourite746+291today47.2
16
node9-ai/node9-proxy
For governing an autonomous AI agent's tool use: Node9-Proxy sits between agent and tools to discover, protect, and review actions.Community favourite211+2today46.6
17
Keesan12/martin-loop
Runaway agent loops on Claude Code or Cursor: it enforces per-session spend caps, verifier safety gates, and runaway loop prevention.Emerging51+9today46.0
18
modelcontextprotocol/servers
Managing GitHub repositories and files: it provides tools for file operations, repository management, and search.Abandoned but popular90,341+726419 days ago45.4
19
spences10/mcp-omnisearch
GitHub code, repository, or user search plus web search, AI answers, and extraction via an MCP server: it exposes a single interface for all.Community favourite347+5today44.0
20
wham/github-brain
For organizations wanting GitHub discussions, issues, and pull request summaries beyond the 100-item API limit: this server stores GitHub data locally and answers in Markdown.Dormant780222 days ago43.8

The ranking, with the evidence

Each position is a weighted mean of adoption (40%), maintenance (24%), momentum (14%), tool description quality (13%) and trust (9%), multiplied by three attenuators: how directly the server is about GitHub (named for it, declaring it, tagged with it, or merely mentioning it), whether its repository is still moving, and how much independent evidence of adoption it has. Open the score on any entry to see every number, including the ones marked ≈, which were imputed from the median of the other candidates rather than measured. The maintenance grade on each entry is mostly issue responsiveness, release recency and open security alerts rather than commits, so a recent commit beside a low grade is two different measurements rather than a contradiction.

  • Abandoned but popular: People use it, but its default branch has stopped moving. Fine to keep running, risky to adopt.
  • Community favourite: Widely adopted and still actively maintained.
  • Dormant: Neither changing nor widely adopted. Here because it still matches the search.
  • Emerging: Small audience, growing quickly, maintained. The bet with the most upside.
  • Steady: Maintained, modest audience, no surprises in either direction.
  • 1

    GitHub MCP Server

    Community favouriteNo change
    github/github-mcp-server ↗

    Best for: Teams that want GitHub's own MCP server for AI assistants: it documents repository browsing, issue and PR automation, and Actions workflow monitoring.`n`n`

    The README documents an MCP server that connects AI tools to GitHub for natural language work with repositories, issues, pull requests, Actions, and security findings. Before choosing it, note that the remote server is hosted by GitHub and requires a compatible MCP host with remote server support, although a local version exists.

    GitHub stars
    32,846
    Stars over the last 90 days: 30,773 at the earliest of 46 readings and 32,846 at the latest, up 2,073.
    Stars / 30 days
    +680
    npm / typical week
    Ships no npm package
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    6 days ago
    Commits / 12 weeks
    200
    Weekly commits over the last 12 weeks, oldest first: 6, 12, 13, 16, 20, 7, 5, 15, 59, 22, 11, 14. 200 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    Not graded
    Score 92.3: show every number behind it
    • Adoption100 / 100 · weight 40%
      • GitHub stars100
      • npm downloadsnot measured
        no npm package
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum75 / 100 · weight 14%
      • Stars gained, relative to size59
      • Stars gained, absolute100
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integrates100
    Weighted mean of the five
    92.3
    × relevance: the keyword is dedicated here
    1.00
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    92.3
  • 2

    github-codemunch-mcp

    Community favouriteNo change
    jgravelle/jcodemunch-mcp ↗

    Best for: For exploring large GitHub repositories and retrieving only the specific functions or classes you need, its tree-sitter AST indexing enables precise symbol search and extraction.

    It indexes a repository locally, then exposes tools to list files, outline symbols, and fetch full source for matched functions or classes. Before choosing it, note that it requires building a local index first, and it is distributed as a Python package rather than an npm module.

    GitHub stars
    2,684
    Stars over the last 90 days: 1,924 at the earliest of 54 readings and 2,685 at the latest, up 761.
    Stars / 30 days
    +123
    npm / typical week
    Ships no npm package
    PyPI / typical week
    25K
    jcodemunch-mcp
    Tools exposed
    7
    Last commit
    today
    Commits / 12 weeks
    1,010
    Weekly commits over the last 12 weeks, oldest first: 28, 22, 36, 32, 70, 93, 70, 97, 130, 92, 292, 46. 1,008 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    A
    Score 82.8: show every number behind it
    • Adoption100 / 100 · weight 40%
      • GitHub stars86
      • PyPI downloads94
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum64 / 100 · weight 14%
      • Stars gained, relative to size86
      • Stars gained, absolute84
      • PyPI download trend0
    • Tool quality76 / 100 · weight 13%
      • Tool description quality68
      • Built and inspected by Glama100
    • Trust0 / 100 · weight 9%
      • License0
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    82.8
    × relevance: the keyword is dedicated here
    1.00
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    82.8
  • 3

    Octocode MCP

    Community favouriteNo change
    bgauryy/octocode ↗

    Best for: Developers researching unfamiliar codebases across local files, GitHub, and npm: it combines local ripgrep/LSP tools with GitHub and package search.

    Octocode exposes 13 tools that cover local code search, file reading, LSP navigation, GitHub repository and PR search, and npm/PyPI package lookup. It requires Node.js 20.12+ and runs via npx, with GitHub authentication optional but recommended for private repositories and higher rate limits.

    GitHub stars
    932
    Stars over the last 90 days: 868 at the earliest of 28 readings and 934 at the latest, up 66.
    Stars / 30 days
    +21
    npm / typical week
    2.8K
    PyPI / typical week
    no attributed package
    Tools exposed
    13
    Last commit
    20 days ago
    Commits / 12 weeks
    24
    Weekly commits over the last 12 weeks, oldest first: 0, 0, 2, 2, 4, 2, 9, 2, 2, 1, 0, 0. 24 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    A
    Score 66.5: show every number behind it
    • Adoption85 / 100 · weight 40%
      • GitHub stars74
      • npm downloads73
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance97 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence85
    • Momentum42 / 100 · weight 14%
      • Stars gained, relative to size58
      • Stars gained, absolute54
      • npm download trend0
    • Tool quality100 / 100 · weight 13%
      • Tool description quality93
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    85.3
    × relevance: the keyword is declared here
    0.78
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    66.5
  • 4

    idea-reality-mcp

    Community favouriteNo change
    mnemox-ai/idea-reality-mcp ↗

    Best for: Before starting a new project: it exposes idea_check, which scans GitHub, Hacker News, npm, PyPI and Stack Overflow for existing competition.

    It exposes one tool, idea_check, which takes a plain-English idea description and returns a reality signal with trend direction, top competitors and pivot suggestions. It is installed with uvx and needs no API key; the README also documents a REST API.

    GitHub stars
    815
    Stars over the last 90 days: 726 at the earliest of 12 readings and 815 at the latest, up 89.
    Stars / 30 days
    +36
    npm / typical week
    Ships no npm package
    PyPI / typical week
    84
    idea-reality-mcp
    Tools exposed
    1
    Last commit
    34 days ago
    Commits / 12 weeks
    36
    Weekly commits over the last 12 weeks, oldest first: 0, 4, 27, 1, 0, 2, 0, 2, 0, 0, 0, 0. 36 in total, and the last figure is the current week so far.
    Maintenance grade
    B
    Tool descriptions
    A
    Score 64.7: show every number behind it
    • Adoption76 / 100 · weight 40%
      • GitHub stars73
      • PyPI downloads21
        PyPI downloads show no weekday rhythm; halved
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance95 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade80
      • Commit cadence100
    • Momentum62 / 100 · weight 14%
      • Stars gained, relative to size81
      • Stars gained, absolute63
      • PyPI download trend26
    • Tool quality93 / 100 · weight 13%
      • Tool description quality85
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    82.9
    × relevance: the keyword is declared here
    0.78
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    64.7
  • 5

    mcp-github-project-manager

    Steady▲ 5
    kunwarVivek/mcp-github-project-manager ↗

    Best for: AI coding agents that need a persistent coordination layer on GitHub Projects v2: it provides task checkout, atomic claims, heartbeat monitoring, and token budgets.

    The server exposes tools for roadmaps, sprint planning, milestones, issues, draft issues, pull requests, and GitHub projects, and the README documents agent self-assignment, heartbeat monitoring, review workflows, and token budgets. Choosing it requires GITHUB_TOKEN, GITHUB_OWNER, and GITHUB_REPO, and assumes all coordination state lives in GitHub issues, projects, and comments.

    GitHub stars
    97
    Stars over the last 90 days: 90 at the earliest of 84 readings and 97 at the latest, up 7.
    Stars / 30 days
    +4
    npm / typical week
    49
    PyPI / typical week
    no attributed package
    Tools exposed
    84
    Last commit
    6 days ago
    Commits / 12 weeks
    68
    Weekly commits over the last 12 weeks, oldest first: 0, 0, 0, 25, 0, 0, 38, 0, 0, 0, 1, 4. 68 in total, and the last figure is the current week so far.
    Maintenance grade
    C
    Tool descriptions
    C
    Score 63.6: show every number behind it
    • Adoption55 / 100 · weight 40%
      • GitHub stars50
      • npm downloads36
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance89 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade55
      • Commit cadence100
    • Momentum33 / 100 · weight 14%
      • Stars gained, relative to size54
      • Stars gained, absolute29
      • npm download trend0
    • Tool quality51 / 100 · weight 13%
      • Tool description quality43
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    63.6
    × relevance: the keyword is dedicated here
    1.00
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    63.6
  • 6

    Kindly Web Search MCP Server

    Community favourite▼ 1
    Shelpuk-AI-Technology-Consulting/kindly-web-search-mcp-server ↗

    Best for: Debugging a coding problem that needs StackOverflow, GitHub Issues, arXiv, or Wikipedia content: it returns the full conversation in one call.

    The README documents web_search and get_content, which return search results and page content in Markdown, and says it integrates with StackOverflow, GitHub Issues, arXiv, and Wikipedia. Before choosing it, note that it has no published npm package and no attributed PyPI package.

    GitHub stars
    385
    Stars over the last 90 days: 349 at the earliest of 14 readings and 385 at the latest, up 36.
    Stars / 30 days
    +14
    npm / typical week
    Ships no npm package
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    3 days ago
    Commits / 12 weeks
    278
    Weekly commits over the last 12 weeks, oldest first: 0, 2, 0, 4, 0, 16, 0, 0, 4, 0, 137, 115. 278 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    Not graded
    Score 59.2: show every number behind it
    • Adoption65 / 100 · weight 40%
      • GitHub stars65
      • npm downloadsnot measured
        no npm package
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum59 / 100 · weight 14%
      • Stars gained, relative to size67
      • Stars gained, absolute48
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    75.9
    × relevance: the keyword is declared here
    0.78
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    59.2
  • 7

    GitMCP

    Abandoned but popular▼ 1
    idosal/git-mcp ↗

    Best for: Developers using AI assistants like Cursor with niche or recently changed GitHub projects: it exposes up-to-date repository docs and code through a URL-based MCP endpoint.

    It exposes 32 tools spanning Git operations, GitHub and Gitea repository management, releases, auth, configuration, backups, and health checks. It is a hosted cloud MCP endpoint reached by URL, so clients need network access to gitmcp.io unless the server is self-hosted.

    GitHub stars
    8,376
    Stars over the last 90 days: 8,194 at the earliest of 8 readings and 8,376 at the latest, up 182.
    Stars / 30 days
    +57
    npm / typical week
    downloads not counted
    PyPI / typical week
    no attributed package
    Tools exposed
    32
    Last commit
    129 days ago
    Commits / 12 weeks
    0
    Maintenance grade
    F
    Tool descriptions
    C
    Score 55.7: show every number behind it
    • Adoption98 / 100 · weight 40%
      • GitHub stars98
      • npm downloadsnot measured
        npm names no repository for git-mcp, so its downloads cannot be attributed
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance40 / 100 · weight 24%
      • Last commit touching this server68
      • Repository maintenance grade5
      • Commit cadence5
    • Momentum49 / 100 · weight 14%
      • Stars gained, relative to size34
      • Stars gained, absolute71
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality53 / 100 · weight 13%
      • Tool description quality45
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    71.4
    × relevance: the keyword is declared here
    0.78
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    55.7
  • 8

    Skill Seekers

    Community favourite▼ 1
    yusufkaraaslan/Skill_Seekers ↗

    Best for: When you need to convert docs, GitHub repos, PDFs, videos, and codebases into AI-ready skills from Claude Code, it exposes scraping, packaging, and upload tools.

    The server exposes 40 tools for scraping documentation, GitHub repositories, PDFs, videos, and local codebases, generating configs, packaging skills, uploading to LLM platforms, exporting to vector databases, and managing workflows and marketplaces. It assumes the Python package is installed with the mcp extra, because the core install does not include the MCP server.

    GitHub stars
    14,963
    Stars over the last 90 days: 14,307 at the earliest of 13 readings and 14,963 at the latest, up 656.
    Stars / 30 days
    +208
    npm / typical week
    Ships no npm package
    PyPI / typical week
    3.4K
    skill-seekers
    Tools exposed
    40
    Last commit
    yesterday
    Commits / 12 weeks
    66
    Weekly commits over the last 12 weeks, oldest first: 0, 3, 0, 15, 2, 5, 20, 1, 0, 18, 1, 1. 66 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    B
    Score 54.7: show every number behind it
    • Adoption100 / 100 · weight 40%
      • GitHub stars100
      • PyPI downloads38
        PyPI downloads show no weekday rhythm; halved
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum74 / 100 · weight 14%
      • Stars gained, relative to size48
      • Stars gained, absolute94
      • PyPI download trend96
    • Tool quality61 / 100 · weight 13%
      • Tool description quality53
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    91.2
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    54.7
  • 9

    cve-mcp

    Community favouriteNo change
    badchars/cve-mcp ↗

    Best for: Incident response and dependency audits: it exposes 41 tools that pull CVE, exploit, and package-impact data from 11 vulnerability sources through one MCP server.

    The server exposes 41 MCP tools for querying NVD, EPSS, CISA KEV, GitHub Advisory, OSV, Shodan, VulnCheck, Vulners, Nuclei, Metasploit, CIRCL, and AttackerKB, including CVE enrichment, exploit checks, and risk scoring. Before installing it, know that it is published as an npm package and the README specifies the Bun runtime.

    GitHub stars
    27
    Stars over the last 90 days: 8 at the earliest of 12 readings and 27 at the latest, up 19.
    Stars / 30 days
    +8
    npm / typical week
    413
    PyPI / typical week
    no attributed package
    Tools exposed
    41
    Last commit
    70 days ago
    Commits / 12 weeks
    5
    Weekly commits over the last 12 weeks, oldest first: 2, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0. 5 in total, and the last figure is the current week so far.
    Maintenance grade
    B
    Tool descriptions
    A
    Score 54.4: show every number behind it
    • Adoption61 / 100 · weight 40%
      • GitHub stars36
      • npm downloads56
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance81 / 100 · weight 24%
      • Last commit touching this server88
        dated from the last commit on the default branch, re-read from GitHub at publication; github.com shows a push 5 days ago, which counts every ref; the stored date would have published 5 days ago
      • Repository maintenance grade80
      • Commit cadence65
    • Momentum50 / 100 · weight 14%
      • Stars gained, relative to size86
      • Stars gained, absolute37
      • npm download trend0
    • Tool quality76 / 100 · weight 13%
      • Tool description quality68
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    69.7
    × relevance: the keyword is declared here
    0.78
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    54.4
  • 10

    GitHub Stars MCP Server

    Steady▼ 2
    miantiao-me/github-stars ↗

    Best for: Finding a previously starred repository from a description: it indexes the READMEs of a user's starred repositories and provides natural-language search.

    The README documents a search_github_stars tool that takes a natural-language query and returns matching starred repositories with relevant README content. Choosing it assumes a Cloudflare-backed deployment: a Cloudflare account, an R2 bucket, AutoRAG configuration, and a GitHub token with repo scope are all required.

    GitHub stars
    113
    Stars over the last 90 days: 111 at the earliest of 13 readings and 113 at the latest, up 2.
    Stars / 30 days
    +1
    npm / typical week
    downloads not counted
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    2 days ago
    Commits / 12 weeks
    15
    Weekly commits over the last 12 weeks, oldest first: 1, 1, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1. 15 in total, and the last figure is the current week so far.
    Maintenance grade
    B
    Tool descriptions
    Not graded
    Score 54.1: show every number behind it
    • Adoption51 / 100 · weight 40%
      • GitHub stars51
      • npm downloadsnot measured
        npm names no repository for mcp-github-stars, so its downloads cannot be attributed
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance92 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade80
      • Commit cadence85
    • Momentum23 / 100 · weight 14%
      • Stars gained, relative to size29
      • Stars gained, absolute15
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    63.6
    × relevance: the keyword is dedicated here
    1.00
    × continuity: actively changing
    1.00
    × evidence: modest but real audience
    0.85
    Composite score
    54.1
  • 11

    github-security-mcp

    Abandoned but popularNew
    badchars/github-security-mcp ↗

    Best for: AI agents that need a one-command GitHub org and repo security audit: it exposes a tool that runs all 45 checks and aggregates findings.

    It exposes 39 tools that audit organization settings, repositories, Actions workflows, secrets, supply chain, and access control, and a single tool can execute all checks sequentially. It runs under the Bun runtime and expects a GitHub personal access token with admin:org and repo scopes.

    GitHub stars
    12
    Stars over the last 90 days: 9 at the earliest of 9 readings and 12 at the latest, up 3.
    Stars / 30 days
    0
    npm / typical week
    298
    PyPI / typical week
    no attributed package
    Tools exposed
    39
    Last commit
    184 days ago
    Commits / 12 weeks
    0
    Maintenance grade
    D
    Tool descriptions
    A
    Score 52.6: show every number behind it
    • Adoption57 / 100 · weight 40%
      • GitHub stars28
      • npm downloads53
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance46 / 100 · weight 24%
      • Last commit touching this server68
      • Repository maintenance grade30
      • Commit cadence5
    • Momentum0 / 100 · weight 14%
      • Stars gained, relative to size0
      • Stars gained, absolute0
      • npm download trend0
    • Tool quality76 / 100 · weight 13%
      • Tool description quality68
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    52.6
    × relevance: the keyword is dedicated here
    1.00
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    52.6
  • 12

    jscpd

    Community favourite▲ 1
    kucherenko/jscpd ↗

    Best for: Before writing or committing a block: check_duplication tests a snippet against the scanned project.

    It exposes four tools: check_duplication for snippets, get_file_clones for file clones, get_statistics for scan statistics, and check_current_directory to rescan. The scope to know: duplication checks apply only to paths the server was started with, so re-scanning via check_current_directory is needed after edits.

    GitHub stars
    6,193
    Stars / 30 days
    no snapshot history
    npm / typical week
    Ships no npm package
    PyPI / typical week
    no attributed package
    Tools exposed
    4
    Last commit
    today
    Commits / 12 weeks
    370
    Weekly commits over the last 12 weeks, oldest first: 12, 4, 28, 7, 10, 8, 10, 89, 35, 48, 51, 56. 358 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    A
    Score 50.4: show every number behind it
    • Adoption95 / 100 · weight 40%
      • GitHub stars95
      • npm downloadsnot measured
        no npm package
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum≈0 / 100 · weight 14%
      • Stars gained, relative to sizenot measured
        no snapshot history yet
      • Stars gained, absolutenot measured
        no snapshot history yet
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality100 / 100 · weight 13%
      • Tool description quality93
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integrates100
    Weighted mean of the five
    84.0
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    50.4
  • 13

    pipelock

    Community favourite▼ 2
    luckyPipewrench/pipelock ↗

    Best for: Wrapping an existing MCP server in a security boundary: it scans both directions for credential leaks, prompt injection, and tool description poisoning.

    It is a proxy that sits between AI agents and the network, inspecting mediated HTTP, WebSocket, MCP, and A2A traffic, plus CONNECT tunnel contents when TLS interception is enabled, for secret exfiltration, prompt injection, SSRF, tool poisoning, and risky tool-call chains. Plain CONNECT tunnels without TLS interception are scanned only at the hostname and URL level: enabling TLS interception is required to scan their contents.

    GitHub stars
    842
    Stars over the last 90 days: 720 at the earliest of 64 readings and 842 at the latest, up 122.
    Stars / 30 days
    +51
    npm / typical week
    Ships no npm package
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    today
    Commits / 12 weeks
    700
    Weekly commits over the last 12 weeks, oldest first: 25, 55, 75, 50, 54, 49, 52, 66, 43, 80, 76, 75. 700 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    Not graded
    Score 49.7: show every number behind it
    • Adoption73 / 100 · weight 40%
      • GitHub stars73
      • npm downloadsnot measured
        no npm package
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum85 / 100 · weight 14%
      • Stars gained, relative to size95
      • Stars gained, absolute69
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    82.8
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    49.7
  • 14

    Loki Mode

    Community favourite▼ 2
    asklokesh/loki-mode ↗

    Best for: From a written spec to a verified product build: it runs autonomously and exposes MCP tools for task queue, code search, and verification reports.

    The server is the MCP interface to Loki Mode, exposing stdio tools for project state and task-queue operations, memory retrieve/store, code search, quality and verification reports, repo hotspots/co-changes, and structured findings/learnings. The server has never been inspected, so its tool list is unknown.

    GitHub stars
    1,057
    Stars over the last 90 days: 980 at the earliest of 48 readings and 1,059 at the latest, up 79.
    Stars / 30 days
    +16
    npm / typical week
    2.7K
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    today
    Commits / 12 weeks
    956
    Weekly commits over the last 12 weeks, oldest first: 16, 87, 43, 58, 56, 358, 172, 49, 17, 22, 0, 115. 993 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    Not graded
    Score 48.8: show every number behind it
    • Adoption87 / 100 · weight 40%
      • GitHub stars76
      • npm downloads73
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum36 / 100 · weight 14%
      • Stars gained, relative to size47
      • Stars gained, absolute49
      • npm download trend0
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    81.3
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    48.8
  • 15

    mcp-skylos

    Community favouriteNo change
    duriantaco/skylos ↗

    Best for: Pre-merge review of AI-generated code: it exposes static-analysis tools such as security_scan and validate_code_change for dead code, secrets, and quality issues.

    The server exposes 12 tools for static analysis, including analyze, security_scan, secrets_scan, quality_check, remediate, and validate_code_change for checking a diff before it lands. It runs locally by default and can also generate a GitHub Actions PR gate with skylos cicd init.

    GitHub stars
    746
    Stars over the last 90 days: 457 at the earliest of 44 readings and 799 at the latest, up 342.
    Stars / 30 days
    +291
    npm / typical week
    Ships no npm package
    PyPI / typical week
    19.6K
    skylos
    Tools exposed
    12
    Last commit
    today
    Commits / 12 weeks
    156
    Weekly commits over the last 12 weeks, oldest first: 14, 6, 5, 5, 9, 20, 17, 14, 17, 5, 21, 25. 158 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    D
    Score 47.2: show every number behind it
    • Adoption79 / 100 · weight 40%
      • GitHub stars72
      • PyPI downloads46
        PyPI downloads show no weekday rhythm; halved
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum75 / 100 · weight 14%
      • Stars gained, relative to size100
      • Stars gained, absolute99
      • PyPI download trend0
    • Tool quality28 / 100 · weight 13%
      • Tool description quality20
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    78.7
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    47.2
  • 16

    Node9-Proxy

    Community favouriteNo change
    node9-ai/node9-proxy ↗

    Best for: For governing an autonomous AI agent's tool use: Node9-Proxy sits between agent and tools to discover, protect, and review actions.

    Node9-Proxy ships as the npm package @node9/proxy and, per its README, interposes between an AI agent and its tools with CLI commands for scanning sessions, checking posture, scanning repos, sandboxing agents, and enabling shields. Before choosing it, note that its MCP tool list is unknown: this server has never been inspected.

    GitHub stars
    211
    Stars over the last 90 days: 205 at the earliest of 37 readings and 211 at the latest, up 6.
    Stars / 30 days
    +2
    npm / typical week
    1.2K
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    today
    Commits / 12 weeks
    621
    Weekly commits over the last 12 weeks, oldest first: 41, 91, 76, 53, 48, 16, 0, 17, 42, 39, 102, 96. 621 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    Not graded
    Score 46.6: show every number behind it
    • Adoption74 / 100 · weight 40%
      • GitHub stars58
      • npm downloads65
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum44 / 100 · weight 14%
      • Stars gained, relative to size30
      • Stars gained, absolute19
      • npm download trend100
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    77.7
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    46.6
  • 17

    MartinLoop — Stop Runaway Loops, Bad Code & Token Waste

    Emerging▲ 1
    Keesan12/martin-loop ↗

    Best for: Runaway agent loops on Claude Code or Cursor: it enforces per-session spend caps, verifier safety gates, and runaway loop prevention.

    MartinLoop exposes 24 MCP tools that govern an AI coding run: martin_run executes a run after workflow admission, while martin_plan, martin_preflight, martin_pause, and martin_cancel shape the run before and during execution. It requires a configured verifier before it will mark a run VERIFIED, and that marker only proves the checks that verifier ran, not that the code is bug-free or safe to merge.

    GitHub stars
    51
    Stars over the last 90 days: 39 at the earliest of 18 readings and 51 at the latest, up 12.
    Stars / 30 days
    +9
    npm / typical week
    242
    PyPI / typical week
    no attributed package
    Tools exposed
    24
    Last commit
    today
    Commits / 12 weeks
    437
    Weekly commits over the last 12 weeks, oldest first: 50, 15, 12, 33, 19, 18, 0, 11, 143, 43, 23, 70. 437 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    A
    Score 46.0: show every number behind it
    • Adoption57 / 100 · weight 40%
      • GitHub stars43
      • npm downloads51
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum74 / 100 · weight 14%
      • Stars gained, relative to size86
      • Stars gained, absolute40
      • npm download trend95
    • Tool quality81 / 100 · weight 13%
      • Tool description quality73
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    76.7
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    46.0
  • 18

    GitHub MCP Server

    Abandoned but popular▼ 1
    modelcontextprotocol/servers ↗

    Best for: Managing GitHub repositories and files: it provides tools for file operations, repository management, and search.

    It provides MCP tools for the GitHub API covering file operations, repository management, and search. Its tool list has not been inspected, so specific capabilities must be confirmed from the repository.

    GitHub stars
    90,341
    6,453 after dividing by the 14 servers in this repositoryStars over the last 90 days: 87,401 at the earliest of 86 readings and 90,341 at the latest, up 2,940.
    Stars / 30 days
    +726
    npm / typical week
    downloads not counted
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    419 days ago
    Commits / 12 weeks
    71
    Weekly commits over the last 12 weeks, oldest first: 2, 20, 0, 1, 0, 18, 0, 0, 3, 14, 13, 0. 71 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    Not graded
    Score 45.4: show every number behind it
    • Adoption95 / 100 · weight 40%
      • GitHub stars95
      • npm downloadsnot measured
        npm names no repository for @modelcontextprotocol/server-github, so its downloads cannot be attributed
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance42 / 100 · weight 24%
      • Last commit touching this server42
        dated from the last commit on the default branch, re-read from GitHub at publication; github.com shows a push 12 days ago, which counts every ref
      • Repository maintenance gradenot measured
        repository is active but this server inside it is not
      • Commit cadencenot measured
        repository is active but this server inside it is not
    • Momentum62 / 100 · weight 14%
      • Stars gained, relative to size37
      • Stars gained, absolute100
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality≈76 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glama100
    • Trust≈100 / 100 · weight 9%
      • License≈100
        no license detected
      • Published by the vendor it integrates100
    Weighted mean of the five
    75.7
    × relevance: the keyword is dedicated here
    1.00
    × continuity: no change in over a year
    0.60
    × evidence: widely adopted
    1.00
    Composite score
    45.4
  • 19

    mcp-omnisearch

    Community favouriteNew
    spences10/mcp-omnisearch ↗

    Best for: GitHub code, repository, or user search plus web search, AI answers, and extraction via an MCP server: it exposes a single interface for all.

    It exposes web search, AI search, and web extraction tools; its README also documents a GitHub search tool. It depends on external provider API keys, but providers without a key are skipped and the rest keep working.

    GitHub stars
    347
    Stars over the last 90 days: 326 at the earliest of 40 readings and 347 at the latest, up 21.
    Stars / 30 days
    +5
    npm / typical week
    downloads not counted
    PyPI / typical week
    no attributed package
    Tools exposed
    3
    Last commit
    today
    Commits / 12 weeks
    93
    Weekly commits over the last 12 weeks, oldest first: 8, 3, 0, 15, 6, 5, 5, 9, 15, 17, 5, 5. 93 in total, and the last figure is the current week so far.
    Maintenance grade
    A
    Tool descriptions
    A
    Score 44.0: show every number behind it
    • Adoption64 / 100 · weight 40%
      • GitHub stars64
      • npm downloadsnot measured
        npm names no repository for mcp-omnisearch, so its downloads cannot be attributed
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance100 / 100 · weight 24%
      • Last commit touching this server100
      • Repository maintenance grade100
      • Commit cadence100
    • Momentum39 / 100 · weight 14%
      • Stars gained, relative to size43
      • Stars gained, absolute33
      • npm download trendnot measured
        no download history for the selected registry
    • Tool quality73 / 100 · weight 13%
      • Tool description quality65
      • Built and inspected by Glama100
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    73.3
    × relevance: the keyword is tagged here
    0.60
    × continuity: actively changing
    1.00
    × evidence: widely adopted
    1.00
    Composite score
    44.0
  • 20

    GitHub Brain MCP Server

    DormantNew
    wham/github-brain ↗

    Best for: For organizations wanting GitHub discussions, issues, and pull request summaries beyond the 100-item API limit: this server stores GitHub data locally and answers in Markdown.

    The README documents a stdio MCP server with a TUI for GitHub login, pulling data into a local database, and configuration; the MCP server then responds to summary questions using Markdown output. Before choosing it, note that it requires an ORGANIZATION value and an initial pull before the MCP server can serve summaries.

    GitHub stars
    78
    Stars over the last 90 days: 77 at the earliest of 10 readings and 78 at the latest, up 1.
    Stars / 30 days
    0
    npm / typical week
    14
    PyPI / typical week
    no attributed package
    Tools exposed
    never inspected
    Last commit
    222 days ago
    Commits / 12 weeks
    0
    Maintenance grade
    B
    Tool descriptions
    Not graded
    Score 43.8: show every number behind it
    • Adoption49 / 100 · weight 40%
      • GitHub stars47
      • npm downloads13
        downloads show none of the weekday rhythm human traffic has; halved
      • Used through Glamanot measured
        not used through Glama in the last 30 days
    • Maintenance58 / 100 · weight 24%
      • Last commit touching this server68
      • Repository maintenance grade80
      • Commit cadence5
    • Momentum0 / 100 · weight 14%
      • Stars gained, relative to size0
      • Stars gained, absolute0
      • npm download trend0
    • Tool quality≈68 / 100 · weight 13%
      • Tool description quality≈68
        tool descriptions not yet scored
      • Built and inspected by Glamanot measured
        never built and inspected by Glama
    • Trust100 / 100 · weight 9%
      • License100
      • Published by the vendor it integratesnot measured
        not published by the vendor it integrates
    Weighted mean of the five
    51.5
    × relevance: the keyword is dedicated here
    1.00
    × continuity: actively changing
    1.00
    × evidence: modest but real audience
    0.85
    Composite score
    43.8

Questions people ask

Should I use github/github-mcp-server or modelcontextprotocol/servers?

Use the GitHub MCP Server (github/github-mcp-server). It is GitHub's official server, is labelled Community favourite, and had a commit 6 days ago and 200 commits in the last 12 weeks. The modelcontextprotocol/servers variant is labelled Abandoned but popular and had a last commit 419 days ago.

When would I prefer github-codemunch-mcp over the official one?

Prefer github-codemunch-mcp when you need to retrieve specific functions or classes from a large repository while reducing token use. Its described approach is tree-sitter AST parsing to extract symbol signatures and summaries. It exposes 7 tools and had a commit 0 days ago and 1,010 commits in the last 12 weeks.

Which security server should I pick: github-security-mcp or cve-mcp?

Use github-security-mcp for a GitHub org and repository security audit; it has 39 tools. Be aware that it is labelled Abandoned but popular, with a last commit 184 days ago and 0 commits in the last 12 weeks. Use cve-mcp for vulnerability intelligence from sources including GitHub Advisory and OSV; it has 41 tools and had a commit 70 days ago and 5 commits in the last 12 weeks.

What should I be careful about before using mcp-skylos?

mcp-skylos is actively maintained, with a last commit 0 days ago and 156 commits in the last 12 weeks. It exposes 12 static analysis tools, but its tool description grade is D. Test how the static-analysis tools are understood by your agent before relying on them.

What can guard an agent's actions against leaks and wasted tool calls?

pipelock scans both directions for credential leaks, prompt injection, and tool description poisoning, and it had a commit 0 days ago and 700 commits in the last 12 weeks. Node9-Proxy sits between the agent and tools for discovery, protection, and review, and had a commit 0 days ago and 621 commits in the last 12 weeks. MartinLoop is the one aimed at session spend caps and runaway loops.

Other comparisons