"How to use GitHub to pull, push code, create PRs, and trigger actions" matching MCP servers:

Audits GitHub Actions workflow files for supply-chain risks like script injection, leaked tokens, unpinned actions, and broad permissions.

Enables scanning GitHub Actions workflow YAML for real-world security vulnerabilities such as script injection from attacker-controlled expressions, unpinned third-party actions, missing permissions blocks, and dangerous pull_request_target checkouts. It returns each finding with its exact location, an explanation of the risk, and a concrete remediation.

Scaffold and audit Starter Series projects — MCP server, Claude Code skill, and CLI in one package.

Enables reviewing GitHub Actions workflows for outdated actions, deprecated Node runtimes, retired runners, deprecated commands, and security risks, with file, line, and fix for each finding.

Scans GitHub Actions workflow files for dangerous triggers, template injection, unpinned actions, excessive permissions, and secrets in shell commands before they are committed, exposing the checks as MCP tools for agents.

An MCP server that sends plain-text Gmail messages only to a predefined allowlist, using generated recipient IDs instead of email addresses to enforce security.

Comprehensive MCP server for analyzing GitHub pull requests, detecting security vulnerabilities, assessing code quality, and providing risk ratings across multiple languages.

Enables AI assistants to scan project dependencies and Infrastructure as Code files for security vulnerabilities and misconfigurations. It also provides automated fixing capabilities to remediate identified security issues.

Safety middleware for AI computer use agents that monitors, enforces policies, and provides guardrails to enable safe desktop interaction.

Enables a constrained subagent to perform foreground GUI actions on Hyprland—observing, focusing windows, clicking, typing, scrolling, dragging, and managing the clipboard—under per-action approval with lease, audit log, and kill-switch gating.

Strict AI code reviewer powered by Groq. Finds bugs, vulnerabilities and security issues in your code. Supports analyze, compare versions, explain code, generate tests, and HTML reports.

Enables safe GitHub automation by queuing write operations for admin approval before execution.

An MCP server that enables AI agents to perform comprehensive GitHub security audits across org settings, repositories, Actions workflows, secrets, supply chain, and access control using 39 tools and 45 checks.

A security filter that blocks dangerous code patterns by comparing normalized structural syntax trees against a blacklist of known threats using vector embeddings. It acts as a gatekeeper to prevent malicious code execution by identifying dangerous structures regardless of specific identifiers or literals.

Checks a code repository without running it: Safe, Works and Complete scores with an A-F grade, catching leaked keys, dangerous calls, invented or lookalike packages, broken imports and missing project files. Standard-library Python; MCP tools scan, orphans and explain.

Enables an AI assistant to read, search, summarize, and triage GitHub issues and repository activity through an allowlisted, read-only set of tools, prompts, and resources. Every input is validated, every repository must be explicitly approved, and all third-party issue text is fenced off and marked as untrusted before it reaches the model.

Enables automated pull request review, security vulnerability analysis, and code quality improvement suggestions through any MCP client.

Rate-limits MCP tool calls with Upstash Redis, allowing a configurable number of invocations per sliding window and sharing counters across server instances.

The only Multi-LLM Compliance Engine (GPT-4o + Claude + DeepSeek). Auto-fix GDPR/LGPD risks and more 15 frameworks. code.guard.eu

Enables AI agents to automate macOS desktop GUI applications through a policy-governed MCP proxy over Cua Driver, with fail-closed per-app allowlisting, a hardcoded sensitive-app denylist, an emergency kill-switch, masked audit logging, and self-healing app recovery with durable task journaling.