Provides tools for administering GitHub Enterprise Cloud and Server, including organizations, members, teams, repositories, rulesets, security alerts, Actions, webhooks, security posture assessment, and guarded write/admin operations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-github-enterprise assess the security posture of my org acme"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A safe-by-default Model Context Protocol server for administering GitHub Enterprise (Cloud & Server) from an AI agent — organizations, members, teams, repositories, rulesets, security alerts, and Actions — with a built-in security-posture baseline and governance controls so an agent can help run your enterprise without being able to wreck it.
Part of the dockndevai suite of governed infrastructure MCP servers. Read-only by default · org-scoped · audited · human-confirmed.
Handing an agent an admin token to GitHub is risky: one loose instruction can delete a repo, remove a member, or flip an org public. This server puts the agent behind the same controls you'd give a junior admin:
Read-only until you say otherwise. Tools above the current access mode are never advertised.
Pinned blast radius. An org allowlist and protected (read-only-forever) orgs.
Destructive ops double-gated. Admin mode ＋ an explicit delete flag ＋ a typed confirmation ＋ a human prompt.
Secrets never leak. Webhook secrets and secret-scanning values are redacted before anything reaches the model.
Everything audited. A JSON line per operation to stderr.
Plus the part that makes it useful, not just safe: it ships an opinionated security baseline — assess_org_posture scores a live org and harden_org_settings applies the fix — and two operator skills (secure setup + Actions optimization).
Related MCP server: GitHub Flow MCP
# Read-only, against GitHub Enterprise Cloud
GHE_TOKEN=your-token GHE_MODE=read-only npx -y @dockndevai/mcp-github-enterpriseAdd to Claude Code:
claude mcp add github-enterprise -e GHE_TOKEN="your-token" -e GHE_MODE="read-only" -- npx -y @dockndevai/mcp-github-enterpriseGitHub Enterprise Server: add -e GHE_API_URL="https://HOST/api/v3". Full client configs (Cursor, Windsurf, Codex, VS Code, Claude Desktop) in docs/CLIENTS.md.
First call to run: whoami — confirms the token and base URL are wired correctly.
Variable | Default | Purpose |
| — | Required. Fine-grained PAT, classic PAT, or App installation token. Least privilege. |
|
| Cloud default. GHES: |
| — | Enterprise slug, for enterprise-level audit log / policy. |
|
|
|
| (all visible) | Comma-separated orgs that may be touched. Pin this. |
| — | Orgs readable but never mutated. |
|
| Required (with admin mode) for any destructive op. |
|
| Destructive ops need a typed confirmation matching the target. |
|
| Validate + log writes without sending them. |
|
| JSON audit line per op to stderr. |
|
| Auto-pagination cap (pages of 100). |
|
| Optional laya-guard AI risk gate: |
See .env.example for the complete list.
Registered only up to the active mode: 23 in read-only, 32 in read-write, 38 in admin.
whoami · get_rate_limit · list_organizations · get_organization · list_members · list_teams · list_security_managers · list_repositories · get_repository · get_branch_protection · list_org_rulesets · list_webhooks · get_actions_permissions · list_self_hosted_runners · list_runner_groups · get_actions_cache_usage · list_workflows · list_secret_scanning_alerts · list_code_scanning_alerts · list_dependabot_alerts · get_audit_log · assess_org_posture · recommend_enterprise_setup
read-write+)harden_org_settings · update_org_settings · set_actions_permissions · create_team · set_member_role · create_org_ruleset · protect_branch · update_repo_security · create_webhook
admin, destructive ones also need GHE_ALLOW_DELETE)create_repository · delete_repository · remove_member · delete_team · delete_org_ruleset · delete_webhook
assess_org_posture { org } scores an organization against a built-in baseline and returns per-control findings with a grade:
{
"org": "acme",
"summary": { "score": 60, "grade": "C", "passed": 6, "failed": 4, "high_failures": 2 },
"findings": [
{ "id": "push-protection", "severity": "high", "status": "fail",
"current": false, "recommended": true,
"rationale": "Blocks secrets at push time — the only control that prevents the leak…",
"remediation": "harden_org_settings, or update_org_settings { secret_scanning_push_protection_enabled_for_new_repositories: true }." }
]
}Then harden_org_settings { org } applies the baseline (base read permission, secret scanning + push protection, Dependabot defaults, no public-repo creation, no private forks, commit sign-off) — preview-able with GHE_DRY_RUN=true. recommend_enterprise_setup returns the full enterprise → org → repo setup template.
2FA is reported by the assessor but must be enforced in the org/enterprise authentication UI — GitHub does not expose it as a REST toggle.
Two bundled Agent Skills in .claude/skills:
github-enterprise-admin — the operator playbook: least-privilege token setup, the secure-setup template, the org-policy baseline, and the guardrails for destructive work.
github-actions-optimization — pipeline optimization strategy, a caching strategy (dependencies, Docker layers, cache limits), and self-hosted runners on Kubernetes with actions-runner-controller (ARC): GitHub App/PAT connection, autoscaling, caching across ephemeral pods, and runner isolation.
A third, mcp-suite-maintenance, documents how to safely extend this server.
npm install
npm run typecheck && npm test && npm run build
npm run dev # watch modeArchitecture (shared across the suite): config.ts (env → typed config) · security.ts (pure policy engine, unit-tested) · github/client.ts (REST wrapper) · baseline.ts (pure posture assessor) · tools/{read,write,admin}.ts (capability-tagged). See SECURITY.md and PUBLISHING.md.
MIT © dockndevai
Score an organization against the built-in security baseline (2FA, base permission, secret scanning + push protection, Dependabot, Actions policy). Returns per-control findings (pass/fail/unknown with severity and the exact remediation tool) plus a summary grade. Read-only — it changes nothing; apply fixes with harden_org_settings.
Inputs: org (required).
Report GitHub Actions cache usage — org-wide, or for one repository. Use to spot caches near the 10 GB/repo limit and to size a caching strategy for faster pipelines.
Inputs: org (required), repo.
Fetch the organization's GitHub Actions policy (which repos may run Actions, and which actions are allowed).
Inputs: org (required).
Fetch recent audit-log events for the organization (or the enterprise, when GHE_ENTERPRISE is set), optionally filtered by a search phrase like 'action:repo.destroy' or 'actor:octocat'.
Inputs: org (required), scope, phrase, perPage.
Fetch the protection settings for a branch (required reviews, status checks, signatures, force-push rules).
Inputs: org (required), repo (required), branch (required).
Fetch an organization's full profile and security-relevant settings (2FA, base permission, secret scanning & Dependabot defaults).
Inputs: org (required).
Report the current REST API rate-limit budget (core, search, graphql) and reset times. Use to pace bulk reads.
Inputs: no named parameters.
Fetch a single repository including its security_and_analysis settings (secret scanning, push protection, advanced security).
Inputs: org (required), repo (required).
List the organization's code-scanning (CodeQL/SARIF) alerts with rule, severity, state, and location.
Inputs: org (required), state.
List the organization's Dependabot (vulnerable dependency) alerts with package, severity, state, and the fixing version.
Inputs: org (required), state.
List an organization's members, optionally filtered by role (admin = owners, member = everyone else).
Inputs: org (required), role.
List the organizations the token can see (filtered by GHE_ORG_ALLOWLIST), each flagged if it is protected (readable but never mutated). Start here to discover valid org logins.
Inputs: no named parameters.
List the organization's rulesets (the modern, org-wide replacement for per-repo branch protection).
Inputs: org (required).
List an organization's repositories (name, visibility, default branch, archived), optionally filtered by type.
Inputs: org (required), type.
List the organization's self-hosted runner groups and which repositories may use them (runner isolation).
Inputs: org (required).
List the organization's secret-scanning alerts (type, state, repo, location). The matched secret value itself is dropped and never returned.
Inputs: org (required), state.
List the teams granted the organization's security-manager role (least-privilege security triage).
Inputs: org (required).
List the organization's self-hosted Actions runners (name, status, labels, busy). Use with runner groups to audit where CI executes — e.g. Kubernetes runners managed by actions-runner-controller.
Inputs: org (required).
List an organization's teams with their slugs, privacy, and permissions. Use a team slug with the team tools.
Inputs: org (required).
List the organization's webhooks and their events. Webhook secrets are redacted and never returned.
Inputs: org (required).
List the Actions workflows defined in a repository (name, path, state). Starting point for pipeline optimization.
Inputs: org (required), repo (required).
Return the staged secure-setup template for a GitHub Enterprise — enterprise, organization, and repository level controls with the rationale for each, plus the exact org-settings baseline that harden_org_settings applies. Pure guidance; use assess_org_posture to measure a specific org against it.
Inputs: no named parameters.
Return the identity behind the configured GHE_TOKEN (login, type, and whether it is a user or an app). Use this first to confirm the token and base URL are wired correctly before anything else.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 23 tools
Each tool maps to a distinct resource+action pair: orgs vs repos vs teams vs runners vs each alert family (secret/code/dependabot) are separately named and scoped. The two 'meta' tools are cleanly differentiated (assess_org_posture measures a live org, recommend_enterprise_setup returns a static template), and list_self_hosted_runners vs list_runner_groups vs get_actions_cache_usage have clear boundaries. No tool appears to duplicate another.
Strong verb_noun convention throughout (list_*, get_*, assess_*, recommend_*), with whoami as a conventional exception. Minor inconsistency in scope qualifiers: list_org_rulesets embeds 'org' while sibling tools leave org scope implicit, and get_actions_cache_usage mixes a third noun into the pattern.
23 tools is on the heavy side, but the domain (enterprise/org governance: identity, RBAC, repos, rulesets, Actions, three alert classes, audit) is genuinely broad and each tool covers a distinct slice. Nothing looks like filler, though a few list-only alert tools could be consolidated.
Read-only audit coverage is good, but assess_org_posture and recommend_enterprise_setup both explicitly instruct agents to 'apply fixes with harden_org_settings' — a tool that does not exist in this set, creating a guaranteed dead end. Alert handling is also list-only with no per-alert detail or dismissal/drill-down path, so remediation workflows cannot be completed.
AI-native git hosting — repos, PRs, issues, CI gates, and AI code review over MCP (60 tools).
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Operate GitHub from your AI assistant: repos, PRs, issues, Actions. Previews and read-only mode.
