GitHub MCP Control Plane

{
  "policies": [
    {
      "name": "write-restrictions",
      "tools": ["create_branch", "create_commit", "batch_create_commits"],
      "description": "Restrict write operations to specific repositories and branches",
      "conditions": {
        "repository": {
          "allowedPatterns": ["*"],
          "blockedPatterns": ["protected-*", "production-*"]
        },
        "branch": {
          "blockedPatterns": ["main", "master", "production", "staging"]
        },
        "files": {
          "blockedPaths": [
            ".git",
            ".github/workflows",
            ".env",
            "*.env.*",
            ".envrc"
          ]
        }
      }
    },
    {
      "name": "workflow-restrictions",
      "tools": ["trigger_workflow"],
      "description": "Restrict workflow triggers to specific workflows and branches",
      "conditions": {
        "repository": {
          "allowedPatterns": ["*"]
        },
        "users": {
          "blockedUsers": []
        }
      }
    },
    {
      "name": "read-only-access",
      "tools": ["list_repositories", "fetch_file", "list_files", "get_repository_info"],
      "description": "Read-only operations have minimal restrictions",
      "conditions": {
        "repository": {
          "allowedPatterns": ["*"]
        }
      }
    },
    {
      "name": "batch-operation-limits",
      "tools": ["batch_create_commits"],
      "description": "Additional restrictions for batch operations",
      "conditions": {
        "repository": {
          "allowedPatterns": ["*"]
        },
        "files": {
          "allowedExtensions": [
            "js",
            "ts",
            "jsx",
            "tsx",
            "py",
            "rb",
            "go",
            "rs",
            "java",
            "kt",
            "cs",
            "php",
            "html",
            "css",
            "scss",
            "json",
            "yaml",
            "yml",
            "md",
            "txt",
            "sh",
            "bash",
            "zsh",
            "sql"
          ],
          "blockedPaths": [
            "*.exe",
            "*.dll",
            "*.so",
            "*.dylib",
            "*.bin",
            "*.zip",
            "*.tar",
            "*.gz",
            "*.rar",
            "*.7z"
          ]
        }
      }
    },
    {
      "name": "time-based-restrictions",
      "tools": ["create_commit", "batch_create_commits", "trigger_workflow"],
      "description": "Restrict certain operations to business hours (optional)",
      "conditions": {
        "time": {
          "allowedDays": [0, 1, 2, 3, 4, 5, 6],
          "allowedHours": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23]
        }
      }
    }
  ]
}