GHAS MCP server (GitHub Advanced Security)
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_code_scanning_alertsC | List the current GitHub Advanced Security code scanning alerts for a repository |
| list_secret_scanning_alertsC | List the current GitHub Advanced Security secret scanning alerts for a repository |
| list_dependabot_alertsC | List the current GitHub Dependabot alerts for a repository |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose targeting different types of GitHub Advanced Security alerts: code scanning, Dependabot, and secret scanning. The descriptions explicitly differentiate the alert types, leaving no ambiguity about which tool to use for each security domain.
All tools follow a perfect verb_noun pattern with 'list_' prefix followed by the specific alert type (code_scanning_alerts, dependabot_alerts, secret_scanning_alerts). The naming is completely consistent across all three tools with no deviations in style or structure.
With only 3 tools, the server feels quite thin for GitHub Advanced Security's scope, which includes multiple security domains and potential operations beyond just listing alerts. While the tools cover the core alert types, the count is borderline minimal for what could be a more comprehensive security management interface.
The toolset is severely incomplete for GitHub Advanced Security operations. While it covers listing three types of alerts, there are significant gaps: no ability to create, update, dismiss, or resolve alerts; no access to security overviews or metrics; and no coverage of other GHAS features like code scanning analyses or security advisories. This creates dead ends for agents needing to take action on security findings.