"How to use GitHub" matching MCP servers:

Enables safe GitHub automation by queuing write operations for admin approval before execution.

Enables querying GitHub Security Advisories from a local cloned advisory database using tools like list_advisories and get_advisory.

Safety middleware for AI computer use agents that monitors, enforces policies, and provides guardrails to enable safe desktop interaction.

A web application for securely managing GitHub tokens and providing centralized access to various development tools integrated with GitHub accounts.

Enables Claude to authenticate with GitHub OAuth and access tools for user information, calculations, and GitHub repositories.

A lightweight stdio-to-http relay that enables the GitHub MCP server to authenticate using a GitHub App instead of a Personal Access Token. It automatically manages fine-grained permissions and short-lived tokens for secure, organizational AI agent workflows.

An MCP server with GitHub OAuth for remote connections, providing tools for arithmetic, GitHub user info, and image generation.

Audits GitHub Actions workflow files for supply-chain risks like script injection, leaked tokens, unpinned actions, and broad permissions.

This MCP server enables users to sign in with GitHub and use AI agents to scan entire repositories for leaked secrets such as API keys, passwords, and tokens, delivering a report with the exact file and line plus remediation guidance.

Routes web requests from AI tools through Tor for anonymized fetching, with selective per-URL routing to bypass Tor-blocking sites.

Enables AI coding agents to inspect GitHub repositories and shell commands for download-and-execute payloads, obfuscation, typosquatted dependencies, autorun hooks, and fake-star signals before following or running them.

Enables AI agents to securely use real secrets (API keys, database passwords) by requiring human approval for each release, ensuring secrets never enter the model's context.

Scans diffs, files, and snippets for leaked secrets like AWS keys, GitHub tokens, and private keys, returning redacted findings while running fully locally without network calls.

Scans suspicious messages, URLs, and text for scams inside any MCP-compatible AI assistant. No signup or API key needed for anonymous use.

Lets AI agents check whether an EVM wallet address carries an EIP-7702 delegation across eight chains (Ethereum, Base, BNB Chain, Arbitrum, OP, Polygon, Gnosis, Unichain) and learn how to obtain a deeper paid report with delegate bytecode heuristics and risk levels. Read-only, never touching private keys or seed phrases.

Enables AI assistants to monitor GitHub repository health by calculating health scores, fetching repository metadata, analyzing Dependabot alerts, checking CI/CD status, and retrieving code scanning alerts.

Enables LLMs to access realtime CVE intelligence aggregated from NVD, CISA KEV, EPSS, GitHub advisories, PoC discovery, and Metasploit/Nuclei tooling, providing vulnerability details, exploitation signals, and prioritized triage verdicts.

Enables an AI agent to check whether contracts are covered by ERC-7730 descriptors, preview how transactions and typed-data signatures would appear to a person, and simulate execution outcomes before signing, without holding keys or submitting transactions.

MCP server to easily use compliance-trestle for OSCAL compliance workflows from any MCP-compliant client.

Enables AI agents to securely manage local credentials, obtain short-lived tokens for authenticated API access, and audit every use by purpose.

Provides DNS lookup and email authentication diagnostic tools (SPF, DKIM, DMARC, MX, etc.) for use with MCP-compatible clients. Enables natural language queries to check DNS records and email health.

MCP server that integrates the Phylax verification API, enabling AI assistants to verify packages, repositories, and other MCP servers before use. It exposes tools for verifying artifacts, checking policies, and fetching attestations.

Enables reviewing GitHub Actions workflows for outdated actions, deprecated Node runtimes, retired runners, deprecated commands, and security risks, with file, line, and fix for each finding.

Enables Claude Code, Claude Desktop, and Cursor to perform Taiwan-specific tasks such as Labor Standards Act overtime pay calculations, Taiwan workday calculations, PII masking, real estate transaction lookup, and PDF-to-image conversion locally without API keys.

Enables AI assistants to raise, submit, approve, amend, and cancel purchase orders and onboard suppliers in ERPNext or SAP S/4HANA while enforcing procurement controls such as duplicate detection, budget limits, split-purchase checks, price tolerances, and segregation of duties.

Enables AI agents to use corporate card and expense functions, including balance checks, transaction listing, receipt compliance, expense reporting, and approval workflows, by calling existing REST APIs through a governed gateway with identity, policy, and audit controls.

A secure email gateway MCP server that protects AI agents from prompt injection attacks by scanning emails for malicious instructions before they reach the agent.

Enables agents like Claude Code and Codex to statically scan .zip, .exe, .dll files and GitHub repositories for malware without executing them, explaining likely false positives and letting users dig into reports through natural language.

Supply chain risk scoring for npm, PyPI, and GitHub repos

Exposes user, membership, and role administration tools via MCP, acting as a thin passthrough to a coordinator API with RBAC enforced by the coordinator using caller bearer tokens.

Checks how long ago a package version was published and returns the newest version older than a minimum age (3 days by default), so an agent avoids brand new releases when adding dependencies. Also checks lockfiles across 15 ecosystems; read-only.

Enables any MCP client to look up CVE intelligence — severity summaries, filtered searches, and full per-CVE detail fusing NVD, MITRE-CNA pre-NVD, CISA KEV, EPSS, and GitHub GHSA data — alongside a Shodan-derived internet-exposure footprint showing how many internet-facing services run a version mapping to a given CVE. It is free, keyless, and read-only, and distinguishes verified zeros from unassessed or failed lookups.

Analyzes GitHub Pull Request diffs for security vulnerabilities and data leaks, using a deterministic filter to skip trivial changes and an AI-powered analysis for logic changes.

A demonstration server that reveals security risks by accessing sensitive environment variables, illustrating how MCP tools can potentially leak user data without explicit consent.

A local-first secrets vault for MCP clients that lets AI assistants use secrets by injecting them into child processes, without the plaintext ever entering the model's context.

Enables AI agents to pay per call for live package-safety and GitHub merge-readiness trust signals via the x402 protocol.

Enables agents to search and call the full OPNsense core and plugin API, perform model-validated CRUD and settings operations, and use curated firewall, service, and network tools with optional auto-revert writes.

Enables AI agents to browse customers, bookings, and availability while any booking creation or cancellation stays gated behind a human-approved, single-use token cryptographically bound to the exact arguments. Runs over stdio or Streamable HTTP and enforces the read/write separation in host code with a full audit trail.

An MCP server that enables AI agents to perform comprehensive GitHub security audits across org settings, repositories, Actions workflows, secrets, supply chain, and access control using 39 tools and 45 checks.

Provides cached, structured snapshots of recent CVEs and GitHub Security Advisories, enabling AI agents to lookup CVEs, find vulnerabilities for a package by ecosystem, list recent critical CVEs, and get severity summaries.