{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "record_kind": "external_reference", "title": "GitHub MCP: Repository access and write controls", "system": "GitHub MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "How can an agent review repository access without enabling GitHub MCP writes?", "near_questions": [ "How can I review repository access without enabling writes?", "Can GitHub MCP be restricted to reading pull requests?", "Does a GitHub MCP toolset reduce token permissions?", "What does GitHub MCP lockdown leave unproven?", "Which repositories can this code review connector read?", "Can an issue contain instructions an agent should ignore?", "Does read-only repository access prevent data leaving the client?", "What authentication does the official GitHub MCP use?", "Is the local GitHub MCP operated by GitHub?", "What should be checked before enabling repository write tools?", "What should a saved GitHub connector review contain?", "Does this GitHub trust record test my configuration?" ], "supported_claims": [ { "claim": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-GITLAB-01-v1", "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub MCP server: hosting and authentication", "source_url": "https://github.com/github/github-mcp-server", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "candidate_record_sha256": "5f2e8ea373885332f961a342962445ce6ef7fef62e46adb367c1ccabf3dca50a", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "required_buyer_context": "GitHub-hosted remote MCP and the documented local server configuration; deployment, release and organization policies must be supplied by the buyer. Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "GitHub MCP", "variant": "GitHub-hosted remote MCP and the documented local server configuration; deployment, release and organization policies must be supplied by the buyer." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "GitHub publishes the server and hosts the remote service; a local deployment has its own operator.", "source_ids": [ "github-main", "github-config" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Review repository content, issues and pull requests.", "source_ids": [ "github-main", "github-config" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Repository files, issues and pull requests accessible through the selected tools and credential.", "source_ids": [ "github-main", "github-config" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Write-capable toolsets exist; documented read-only mode excludes their write tools.", "source_ids": [ "github-main", "github-config" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Remote OAuth or PAT authentication is documented; actual repository grants and organization policy require inspection.", "source_ids": [ "github-main", "github-config" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Toolset selection, exclusions and read-only mode are configurable. Lockdown does not reduce the underlying credential's authority.", "source_ids": [ "github-main", "github-config" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Repository results return to the connected client. If that client uses a hosted model, selected content may leave the repository service; inspect that client's data policy.", "source_ids": [ "github-main", "github-config" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad credentials; assuming lockdown prevents all hostile content; enabling a write tool during a review-only task.", "source_ids": [ "github-main", "github-config" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a review-only task, stop before writes; resolve unknown repository grants before reading private repositories.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "github-main", "url": "https://github.com/github/github-mcp-server", "final_url": "https://github.com/github/github-mcp-server", "title": "GitHub MCP server: hosting and authentication", "checked_on": "2026-10-11", "sha256": "34700e0a6091c606a24b73a2ea5e8de5152f0523884f10a74d62f1fb63d4680b", "bytes": 834307 }, { "source_id": "github-config", "url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md", "final_url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md", "title": "GitHub MCP server configuration", "checked_on": "2026-10-11", "sha256": "ffc582722b19340b75f3fefa625360f2cbb5e7e0753779ddb1da819e005b85c2", "bytes": 369942 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Retain the documented read-only and credential boundaries used when reviewing a repository connector.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-mcp-repository-access-trust", "machine_readable_record": "/varexis-index/records/github-mcp-repository-access-trust.json" }