GHAS MCP server (GitHub Advanced Security)

Instructions

Implementation Reference

• src/index.ts:56-63 (registration)

  Registration of the 'list_secret_scanning_alerts' tool in the ListTools response, including name, description, and input schema definition.

  {
      name: "list_secret_scanning_alerts",
      description: "List the current GitHub Advanced Security secret scanning alerts for a repository",
      inputSchema: zodToJsonSchema(z.object({
          owner: z.string(),
          repo: z.string(),
      })),
  },

• src/index.ts:89-95 (handler)

  The handler in the CallToolRequestSchema that parses arguments, calls the implementation function, and formats the response for the 'list_secret_scanning_alerts' tool.

  case "list_secret_scanning_alerts": {
      const args = z.object({ owner: z.string(), repo: z.string() }).parse(request.params.arguments);
      const alerts = await listSecretScanningAlerts(args.owner, args.repo);
      return {
          content: [{ type: "text", text: JSON.stringify(alerts, null, 2) }],
      };
  }

• src/operations/security.ts:103-119 (handler)

  The core implementation function that validates access, uses Octokit to fetch secret scanning alerts from GitHub API, and returns the data.

  export async function listSecretScanningAlerts(owner: string, repo: string) {
      const octokit = await validateAccessToken(owner, repo);
  
      console.log(`Fetching secret scanning alerts for repository: [${owner}/${repo}]`);
      console.log("Starting to fetch secret scanning alerts...");
      try {
          const { data } = await octokit.rest.secretScanning.listAlertsForRepo({
              owner,
              repo
          });
          console.log(`Fetched [${data.length}] secret scanning alerts.`);
          return data;
      } catch (error) {
          console.error("Error fetching secret scanning alerts:", error);
          throw error;
      }
  }