Search public GitHub repositories (GET /search/repositories) by any combination of keywords, topics, language, stars, activity dates and license. Matching: 'query' keywords match the repo name, description and topics (not the README unless you add in:readme). 'topics' is stricter: each listed topic must be an exact tag on the repo, and all of them must be present (AND). If you are unsure of exact topic names, call search_topics first. Archived repos are excluded unless include_archived is true; forks are excluded by GitHub by default. Each result includes: full_name (owner/repo), stars, forks, open issues + PRs (GitHub counts both together), primary language, license (SPDX id), last push date, ARCHIVED/fork flags, description, topics and URL. The response also shows the exact GitHub query used and the total match count. Other GitHub repo attributes can be filtered by adding qualifiers to 'query' (see its description), e.g. forks, size, owner, template status, help-wanted issue count.

Find the exact GitHub topic names for a concept, e.g. 'banking' -> fintech, core-banking, payments. Use the returned names in search_repositories. Featured topics are highlighted by GitHub; curated topics have extra descriptions.

Search issues or pull requests across all public repositories, or within one repo. Useful for finding how others hit and solved a problem (e.g. an error message), or for good-first-issue hunting.

Search source code in public repositories (GitHub requires a token for this endpoint, so it only works when GITHUB_TOKEN or GITHUB_PAT is set). Returns matching files with a short snippet.

Details for one repository: stars, forks, language breakdown, license, topics, activity dates, latest release and the start of the README.

The folder and file structure of a repository, as an indented tree. Use path to focus on a subfolder and max_depth to control detail.

Read one file from a repository (e.g. 'pom.xml', 'package.json', 'src/main.go'). If the path is a folder, lists its contents instead.

List issues in a repository (pull requests are excluded). Filter by state and labels.

List pull requests in a repository. Filter by state and target branch.

Details for one pull request: status, branches, size, description and the list of changed files.

Score (0-100) for whether a repository is alive and well maintained, with a transparent breakdown: recent pushes, commits in the last 90 days, releases, contributor count and concentration (bus factor), and community files (license, CONTRIBUTING, templates). Uses about 5 API requests.

Compare 2-5 repositories side by side: stars, forks, language, license, activity and topics. Set include_health to add health scores (about 5 extra API requests per repo).

Find repositories similar to a given one, using its topics (and optionally its language). Results are ranked by how many topics they share, then by stars. Each result has the same fields as search_repositories (stars, forks, open issues + PRs, language, license, last push, flags, description, topics, URL) plus the list of shared topics. Uses up to 3 searches.

Known vulnerabilities (CVEs) and malware reports for one package from the GitHub Advisory Database: severity, affected and fixed versions, and EPSS exploit likelihood. Pass version to see only advisories that affect it. Part of the security toolkit: for a repository, also use security_audit_dependencies and security_supply_chain_risk. Uses 2 API requests.

Checks every dependency a repository declares against the GitHub Advisory Database for known vulnerabilities and malware, without cloning it. Finds manifests at the repository root automatically (package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, pom.xml, composer.json), or pass path. Part of the security toolkit: also call security_supply_chain_risk for how the project is run, and security_advisories for details on one package. Uses about 2 API requests per manifest plus 2 per ecosystem.

Is this project safe to depend on? Checks the warning signs behind real supply chain attacks (xz-utils, event-stream): bus factor, a newcomer suddenly taking over, dormant-then-burst releases, branch protection, commit and release signing, security policy, private vulnerability reporting, Dependabot or Renovate, published advisories, and the OpenSSF Scorecard result. Part of the security toolkit: also call security_audit_dependencies for known vulnerabilities in its dependencies. Uses about 12 GitHub API requests, plus one call to the public OpenSSF Scorecard API with the repository name.