Safety rating · all kinds

io.github.github/github-mcp-server

Score 67/100 — Moderate public signals

Automated checks of public signals as of the date shown. Not a security audit, certification or endorsement, and not a statement about the people who maintain the project. Signals can be incomplete or out of date; each check shows its evidence and source so anyone can verify it.

Checks

• Authentication posture (as documented publicly) — Not found (0/15): No authentication requirement is documented in the server's public registry entry or the public documentation checked. This is a documentation finding only: Rightshold does not send protocol requests to third-party servers, so the live endpoint was not tested.
• Safety documentation: tool annotations, access scope, injection notes — Partly found (8/12): Tool annotations or read-only markers in public documentation: not documented. Access scope terms: allow-list, read-only, permission, scope. Prompt-injection / untrusted-input notes: prompt injection, untrusted, injection, sanitize.
• License recorded (OSI-approved) — Found (10/10): License MIT (OSI-approved) is recorded in the registry metadata.
• Known advisories for the backing package (OSV) — Not applicable: The registry entry names no backing package, so there is no package version to query against OSV.
• Listing activity (version recency and count) — Found (10/10): Most recent listed version 11 day(s) before the check; 62 version(s) listed.
• TLS posture of the remote endpoint (passive) — Found (8/8): A passive TLS handshake to the recorded remote host succeeds; the certificate is valid until 2026-12-26.
• Registry documentation completeness — Partly found (6/8): Recorded in the registry entry: description present, repository linked, website/docs absent, transport named.