"An overview or guide to GitHub Actions" matching MCP servers:

Audits GitHub Actions workflow files for supply-chain risks like script injection, leaked tokens, unpinned actions, and broad permissions.

Enables scanning GitHub Actions workflow YAML for real-world security vulnerabilities such as script injection from attacker-controlled expressions, unpinned third-party actions, missing permissions blocks, and dangerous pull_request_target checkouts. It returns each finding with its exact location, an explanation of the risk, and a concrete remediation.

Enables reviewing GitHub Actions workflows for outdated actions, deprecated Node runtimes, retired runners, deprecated commands, and security risks, with file, line, and fix for each finding.

Scans GitHub Actions workflow files for dangerous triggers, template injection, unpinned actions, excessive permissions, and secrets in shell commands before they are committed, exposing the checks as MCP tools for agents.

Enables MCP server builders to wrap destructive tools so they preview a plan and do nothing until a human approves via client elicitation or a single-use, argument-bound fallback token, with secrets-free audit logging.

An MCP server that enables AI agents to perform comprehensive GitHub security audits across org settings, repositories, Actions workflows, secrets, supply chain, and access control using 39 tools and 45 checks.

Enables safe GitHub automation by queuing write operations for admin approval before execution.

Enables AI coding agents to read GitHub issues and pull requests and to add comments only on allowlisted repositories, with every call recorded in an append-only redacted audit log.

Enables an AI assistant to read, search, summarize, and triage GitHub issues and repository activity through an allowlisted, read-only set of tools, prompts, and resources. Every input is validated, every repository must be explicitly approved, and all third-party issue text is fenced off and marked as untrusted before it reaches the model.

Enables querying GitHub Security Advisories from a local cloned advisory database using tools like list_advisories and get_advisory.

Enables AI agents to administer GitHub Enterprise (Cloud & Server) — organizations, members, teams, repositories, rulesets, security alerts, and Actions — through guarded MCP tools that are read-only, org-scoped, audited, and human-confirmed by default. It also ships an opinionated security-posture baseline that scores a live organization and can apply hardening fixes.

A Model Context Protocol server that gives AI agents bounded, auditable access to propose changes to an Obsidian vault stored in GitHub, with per-agent expiring tokens, read/write/deny path policies, mutability rules, frontmatter checks, and human-reviewed proposal branches.

A web application for securely managing GitHub tokens and providing centralized access to various development tools integrated with GitHub accounts.

Enables Claude to authenticate with GitHub OAuth and access tools for user information, calculations, and GitHub repositories.

Comprehensive MCP server for analyzing GitHub pull requests, detecting security vulnerabilities, assessing code quality, and providing risk ratings across multiple languages.

A lightweight stdio-to-http relay that enables the GitHub MCP server to authenticate using a GitHub App instead of a Personal Access Token. It automatically manages fine-grained permissions and short-lived tokens for secure, organizational AI agent workflows.

An MCP server with GitHub OAuth for remote connections, providing tools for arithmetic, GitHub user info, and image generation.

A remote MCP server for Cloudflare Workers featuring built-in GitHub OAuth for secure user authentication and identity-based access control to tools. It provides a reference implementation for managing remote MCP connections with persistent state and OAuth provider integration.

An MCP server that sends plain-text Gmail messages only to a predefined allowlist, using generated recipient IDs instead of email addresses to enforce security.

Enables AI assistants to search, inspect, compare, and evaluate GitHub repositories using read-only tools, including topic discovery, repository health scoring, security advisories, dependency audits, and supply-chain risk checks. It returns concise, readable results and can work without a token, with optional authentication for higher rate limits and code search.

Enables AI clients such as ChatGPT and Claude to safely read, analyze, update, verify, and audit GitHub Projects v2 through OAuth-secured MCP connections with role-based access control, guarded writes, bulk preview/approval/apply, checkpoints/deltas, and durable audit trails.

Enables AI coding agents to plan and apply changes that switch GitHub Actions npm publishing to trusted publishing (OIDC). It inspects workflows and package files, reports required edits, and removes reliance on stored npm tokens.

Enables AI clients to audit GitHub repositories for Dependabot, code scanning, and secret scanning alerts, generate conservative remediation plans, and execute verified fixes through MCP tools with fail-closed mutation controls.

This MCP server enables users to sign in with GitHub and use AI agents to scan entire repositories for leaked secrets such as API keys, passwords, and tokens, delivering a report with the exact file and line plus remediation guidance.

Enables AI agents and developers to score npm packages, PyPI packages, and GitHub repositories for maintenance health, producing A–F grades, per-signal details, and plain-language risk lists before adoption. It supports checking individual packages, scanning manifests or lock files for transitive dependencies, and comparing alternatives.

Enables MCP clients to run local, read-only audits that detect risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration before merging.

A gateway that lets an agent read repositories, issues, and pull requests across multiple GitHub user and organization accounts, with a separate token per owner selected automatically server-side so credentials are never exposed to the client. Optional writes such as creating issues are off by default and require per-request administrator approval.

Enables authenticated MCP clients to list, read, prepare, and create support tickets through the existing HTTP API, with OAuth verification, company isolation, and safe write retries.

Provides code auditing tools including repository cloning, AST analysis, security scanning with Semgrep, and LLM-powered code explanations via the Model Context Protocol.

A reference MCP server for Cloudflare Workers that provides remote connection support with integrated GitHub OAuth authentication. It enables developers to build and deploy authenticated remote tools with user-specific access controls and persistent state management.