ghas-mcp-server
About
A Model Context Protocol server that enables querying GitHub Advanced Security (GHAS) alerts for GitHub repositories. It provides tools to list Dependabot, secret scanning, and code scanning alerts. Designed for developers and security teams using MCP-compatible editors like VS…
Explore
Use the buttons to install the server in your VS Code or VS Code Insiders environment. Make sure to read the link before you trust it! The links go to vscode.dev and insiders.vscode.dev and contain instructions to install the server.
VS Code will let you see the configuration before anything happens:
Add the configurations below to your MCP config in the editor.
For VS Code it would look like this:
{
"mcp": {
"inputs": [
{
"id": "github_personal_access_token",
"description": "GitHub Personal Access Token",
"type": "promptString",
"password": true
}
]
},
"servers": {
"ghas-mcp-server": {
"command": "npx",
"args": [
"-y",
"@rajbos/ghas-mcp-server"
],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "${input:github_personal_access_token}"
}
}
}
}
```
npm install
Currently this has the following tools that are supported:
- list_dependabot_alerts: List all dependabot alerts for a repository
- list_secret_scanning_alerts: List all secret scanning alerts for a repository
- list_code_scanning_alerts: List all code scanning alerts for a repository
Make sure to add these three scopes (read only) to the configured PAT and for the correct organization as well!
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
