Skip to main content
Glama
TanNhatCMS

github-binary-mcp

by TanNhatCMS

github-binary-mcp

MCP server riêng (stdio, Node zero-dependency) để push file nhị phân lên GitHub — vá đúng chỗ tool GitHub chính thức thiếu: tool gốc chỉ nhận text và tự base64, nên ảnh gửi qua đó thành chuỗi base64 chứ không phải ảnh. Server này nhận content_base64 và chuyển nguyên văn cho GitHub API.

Tools

  • push_binary_file — 1 file nhị phân (Contents API).

  • push_binary_files — tối đa 20 file trong 1 commit (Git Data API).

  • get_binary_file — đọc file về dạng base64.

  • delete_file — xoá file trong phạm vi cho phép.

Related MCP server: @brycepelletier/github-app-mcp

Cơ chế bảo mật (fail-closed)

  • Token GitHub chỉ lấy từ env GITHUB_TOKEN. Không log, không trả về trong kết quả tool, không xuất hiện trong thông báo lỗi.

  • Allowlist repo GITHUB_BINARY_ALLOWED_REPOS (dạng owner/repo, cách nhau bằng dấu phẩy). Không đặt biến này = từ chối mọi push.

  • Allowlist đường dẫn GITHUB_BINARY_ALLOWED_PATHS (mặc định: assets/,public/,docs/,static/,images/). File ngoài các tiền tố này bị từ chối.

  • Denylist luôn thắng: .github/workflows/, .git/, *.env*, *.pem, *.key, tên chứa credentials hoặc secret. Chặn leo thư mục ...

  • Chặn file thực thi: exe, dll, so, dylib, bat, com, scr, msi, appimage, deb, rpm.

  • Base64 phải hợp lệ và round-trip đúng, nếu không từ chối trước khi gọi API.

  • Audit log: 1 dòng JSON mỗi lần gọi (tool, repo, path, size, sha, ok/error), ra stderr. Không ghi content, không ghi token.

Giới hạn

  • 10 MB mỗi file (sau giải mã), 50 MB mỗi commit nhiều file, tối đa 20 file/commit.

  • 30 lần ghi/xoá mỗi giờ (rolling window, theo process). Đọc không giới hạn.

  • Không bypass branch protection: nếu nhánh bị bảo vệ, GitHub API tự từ chối.

Chạy và kiểm thử

GITHUB_BINARY_MOCK=1 node test.mjs   # 14/14 pass, không chạm mạng
GITHUB_TOKEN=... GITHUB_BINARY_ALLOWED_REPOS=TanNhatCMS/dia-nguc-live node server.mjs

Mock mode (GITHUB_BINARY_MOCK=1) luôn thắng và mọi kết quả đều gắn mock:true, không bao giờ nhầm thành push thật.

Triển khai lên gateway (chưa làm — cần chốt)

  1. Tạo token GitHub cho server này (fine-grained, chỉ các repo trong allowlist, quyền Contents: Read and write).

  2. Đặt server lên flex (STDIO) hoặc đóng gói chạy HTTP, đăng ký vào MetaMCP gateway, gắn vào namespace Public với tool policy allowlist.

  3. Kiểm thử push thật lên 1 repo thử trước khi mở allowlist cho repo chính.

Trạng thái hiện tại: code + test mock xong, đã push lên GitHub tại https://github.com/TanNhatCMS/github-binary-mcp. Chưa triển khai lên flex, chưa có token thật, chưa kiểm thử push thật.

Available Tools

4 tools
delete_fileB

Delete a file under the allowed path prefixes (same allowlist/denylist as push). Rate-limited like pushes.

NameRequiredDescriptionDefault
pathYes
repoYes
ownerYes
branchNo
messageNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden and usefully reveals allowlist/denylist restrictions and rate-limiting behavior. However, it omits important mutation context such as whether deletion is irreversible, what permissions are required, and how branch/message parameters affect behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with the core action front-loaded and no wasted text. The allowlist and rate-limit context is delivered efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive delete operation with no annotations and no output schema, the description is too sparse. It covers path restrictions and rate limits, but omits irreversibility, permission requirements, and the meaning of optional branch/message parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It only clarifies that 'path' is constrained by the allowed path prefixes; it does not explain owner, repo, branch, or message semantics, leaving most of the five parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Delete a file' under allowed path prefixes. It distinguishes the operation from the push/get siblings by explicitly referencing push-related constraints, though it does not directly name an alternative tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool deletes files, but gives no explicit guidance on when to use it versus push_binary_file, push_binary_files, or get_binary_file. It mentions shared allowlist/denylist and rate-limiting behavior but no usage exclusions or routing criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_binary_fileA

Read a file from a repo and return it as base64 (max 10 MB). Denied paths still apply; reads are not rate-limited.

NameRequiredDescriptionDefault
pathYes
repoYes
ownerYes
branchNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral load and does well: it discloses the base64 encoding, a 10 MB ceiling, that denied paths still apply, and that reads are not rate-limited. It omits what happens when a file exceeds 10 MB or is missing/inaccessible (error vs truncation).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, with the core action and size cap front-loaded ahead of the operational caveats. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers return format, size limit, permission inheritance, and rate limits, which is solid for a read tool with no annotations or output schema. Still missing branch selection semantics and failure behavior for oversized or missing files, which an agent needs to invoke it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description compensates for none of it: 'repo' is mentioned in passing, but owner, path, and especially the optional `branch` (default branch behavior is a real ambiguity for file reads) are never explained. All four parameters are undocumented in both places.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read a file from a repo') plus the return format ('base64') and a hard limit ('max 10 MB'). The read-vs-write split against siblings push_binary_file / push_binary_files / delete_file is inferable from the verb, but the description never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent gathers this is the way to fetch file contents. There is no explicit 'use this when...' statement, no note that push_binary_file is the write counterpart, and no guidance on when to prefer a text-read tool over this one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

push_binary_fileA

Push one binary file (image, audio, PDF, zip, ...) to a GitHub repo. content_base64 is forwarded verbatim to the GitHub API — unlike the official GitHub MCP tool, which treats content as plain text. Repo must be in GITHUB_BINARY_ALLOWED_REPOS, path must be under GITHUB_BINARY_ALLOWED_PATHS, max 10 MB.

NameRequiredDescriptionDefault
pathYes
repoYes
ownerYes
branchNo
messageNo
content_base64Yes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose real operational constraints: repo allowlist, path allowlist, and a 10 MB size cap. However, it omits the mutation semantics an agent most needs — whether an existing file at that path is overwritten, whether a commit is created and on which branch by default, and what authorization beyond the allowlist is required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with no filler: purpose first, the differentiating behavior second, hard constraints last. Every clause carries information an agent needs before calling.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-annotation write tool with no output schema and an undocumented schema, the allowlist and size limits are valuable but not sufficient. Missing is what happens on success (a commit on which ref), overwrite semantics for an existing path, and failure modes — all of which the agent would need to call safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate; it clarifies the riskiest parameter by stating content_base64 is forwarded verbatim (implying raw base64, not plain text). The remaining five parameters — owner, repo, path, branch, message — get no explanation at all, and message as a commit message is left guessable from convention.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Push one binary file (image, audio, PDF, zip, ...) to a GitHub repo") and the "one" makes it distinguishable from sibling push_binary_files. It also positions itself against the official GitHub MCP tool, so an agent knows exactly what kind of write this is.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for selection: use this for binary payloads whose base64 must pass through untouched, as opposed to the official GitHub MCP tool that treats content as plain text. It does not explicitly contrast with push_binary_files (batch) or state when not to use it, but the single-vs-many framing is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

push_binary_filesC

Push up to 20 binary files in a single commit via the Git Data API. Same allowlist, denylist and size limits (50 MB total).

NameRequiredDescriptionDefault
repoYes
filesYes
ownerYes
branchNo
messageNo

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full load; it does disclose meaningful behavior: commit semantics via the Git Data API, a 20-file cap, a 50 MB total size cap, and allowlist/denylist enforcement. It omits atomicity (all-or-nothing vs partial failure), whether this creates a new commit or appends to a branch, auth requirements, and error behavior when a path is denied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action and its limits; nothing is padded. The second sentence is efficient but leans on an undefined external reference, which costs a little clarity for its brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter write tool with zero schema descriptions, no annotations, and no output schema, the description is too thin — it should at minimum clarify branch/message defaults and what the call returns (commit SHA or similar) after success.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 5 parameters, so the description must compensate and largely doesn't: it adds meaning only for the files array (binary content, ≤20 entries, 50 MB total), while owner, repo, branch (and its default), message, and the path/content_base64 fields are unexplained. An agent cannot tell from this text whether branch is required or what message defaults to.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (push binary files) plus the batch constraint (up to 20 in a single commit via the Git Data API), which implicitly separates it from the singular sibling push_binary_file. It never names that sibling explicitly, so the differentiation is inferable rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance; the agent must infer from 'up to 20' that this is the batch variant of push_binary_file. 'Same allowlist, denylist and size limits' is a cross-reference to another tool's documentation without naming it, so the guidance is not self-contained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv1.0.0
    • First observeddelete_file
    • First observedget_binary_file
    • First observedpush_binary_file
    • First observedpush_binary_files

TDQS

B3.3/5.0

Scored across 4 tools

Disambiguation4/5

Each tool targets a distinct action (push single, push batch, read, delete) and the descriptions clearly separate the single-file path (verbatim base64) from the multi-file commit path. The only mild overlap is push_binary_file vs push_binary_files, since a single file could plausibly go through either, but the cardinality and API mechanism differences are stated explicitly.

Naming Consistency4/5

All four names are snake_case verb_noun and follow the same shape (push_binary_file(s), get_binary_file, delete_file). The only deviation is that delete_file and get_binary_file drop the 'push_' prefix while delete_file also omits 'binary', but the pattern remains predictable and readable.

Tool Count4/5

Four tools is a tight, purposeful surface for a narrowly scoped binary-file server, and each one maps to a real operation. The single vs batch push pair is arguably a slight over-split of one capability, keeping it just under a perfect score.

Completeness3/5

Create/overwrite, read, and delete are covered, but there is no listing or path-discovery tool, so an agent must already know exact repo paths. GitHub's content API also requires a blob SHA to delete or update an existing file, and nothing states that get_binary_file returns one, leaving a likely dead end for delete/overwrite workflows.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables managing GitHub repositories, files, and user information through MCP, with support for creating, updating, and deleting repository contents, as well as fetching user profiles.
    1
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables self-hosted, read-only remote interaction with GitHub repositories, allowing listing repositories, searching code, and inspecting commits, pull requests, issues, and diffs via authenticated MCP clients.
    221 npm
    MIT