github-mcp-plus (shade-solutions/github-mcp-plus) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 73 tools. No publisher has claimed this listing.

Caution

74/100

github-mcp-plus

Item: github-mcp-plus
Rating: 74
Author: M8ven

Enhanced GitHub MCP server with over 100 tools for repository management, issues, pull requests, organization administration, and more. Runs via npx with zero installation.

→ shade-solutions/github-mcp-plus · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

shade-solutions

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: GITHUB_PERSONAL_ACCESS_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes73 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

actions_list

Lists all GitHub Actions workflows in a repository

actions_run_trigger

Trigger a GitHub Actions workflow run

list_check_runs_for_ref

List check runs for a specific reference (branch, SHA, or tag) to see CI/CD status

list_deployments

List deployments for a repository

create_deployment

Create a deployment for a repository

list_packages_for_org

List packages for an organization

list_codespaces_for_authenticated_user

List codespaces for the authenticated user

get_enterprise

Get information for a specific enterprise

list_enterprise_audit_log

List audit log entries for an enterprise

get_pr_diff

Get the raw diff of a Pull Request

get_commit_diff

Get the raw diff of a Commit

create_release

Create a GitHub Release

list_releases

List releases for a repository

get_latest_release

Get the latest release of a repository

list_tags

List tags in a repository

create_gist

Create a new gist (public or secret)

list_gists

List gists for the authenticated user

create_issue

Create an issue in a repository

issue_read

Read an issue or pull request in a repository

update_issue

Update an existing issue (title, body, state, labels, assignees)

list_issues

List issues in a repository with optional filters

search_issues

Search for issues across GitHub repositories

add_issue_comment

Add a comment to an issue or pull request

list_issue_comments

List comments on an issue or pull request

add_label

Add labels to an issue or pull request

remove_label

Remove a label from an issue or pull request

create_pull_request

Create a pull request in a repository

update_pull_request

Update an existing pull request (title, body, state, base)

merge_pull_request

Merge a pull request in a repository

list_pull_requests

List pull requests in a repository

list_pr_files

List the files changed in a pull request

add_pr_review_comment

Add a review comment to a pull request (inline comment on a specific file/line)

get_pr_comments

List all review comments on a pull request

submit_pr_review

Submit a review on a pull request (approve, request changes, or comment)

get_pull_request

Get detailed information about a specific pull request (includes status like mergeable)

list_public_ssh_keys_for_authenticated_user

List public SSH keys for the authenticated user

add_public_ssh_key_for_authenticated_user

Add a public SSH key for the authenticated user

list_gpg_keys_for_authenticated_user

List GPG keys for the authenticated user

add_gpg_key_for_authenticated_user

Add a GPG key for the authenticated user

list_repo_webhooks

List webhooks for a repository

create_repo_webhook

Create a webhook for a repository

list_notifications_for_authenticated_user

List notifications for the authenticated user

list_code_scanning_alerts_for_repo

List code scanning alerts for a repository

list_repo_invitations

List invitations for a repository

get_file_contents

Get the contents of a file or directory in a repository

create_or_update_file

Create or update a file in a repository

delete_file

Delete a file from a repository

search_repositories

Search for repositories on GitHub

create_repository

Create a new repository for the authenticated user

fork_repository

Fork a repository to your account

create_branch

Create a new branch from an existing reference (branch, tag, or SHA)

list_branches

List branches in a repository

list_commits

List commits on a repository branch

get_commit

Get details of a specific commit including files changed

get_repository_tree

Get the full file tree of a repository (recursive listing of all files)

list_contributors

List contributors to a repository

search_code

Search for code across GitHub repositories

search_users

Search for GitHub users

star_repository

Star a repository

unstar_repository

Unstar a repository

list_stargazers

List users who have starred a repository

list_starred_repositories

List repositories starred by the authenticated user (or another user)

get_repository

Get detailed information about a specific repository (including parent if it's a fork)

sync_fork

Sync a fork with its upstream repository (merge default branch of upstream into current fork)

get_me

Get the authenticated user

update_authenticated_user

Update the authenticated user's profile

list_emails_for_authenticated_user

List email addresses for the authenticated user

follow_user

Follow a user

unfollow_user

Unfollow a user

list_orgs_for_authenticated_user

List organizations the authenticated user is a member of

get_org

Get an organization's profile

list_org_members

List members of an organization

list_org_teams

List teams in an organization

// known CVEs in dependencies2 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.6.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.6.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowesbuild@0.27.3GHSA-g7r4-m6w7-qqqr

esbuild allows arbitrary file read when running the development server on Windows

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

🔐 secretGITHUB_PERSONAL_ACCESS_TOKEN"": "your-github-token"

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

73/73 tools missing one or more hints — actions_list (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); actions_run_trigger (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_check_runs_for_ref (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +70 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.6.0 (high), @modelcontextprotocol/sdk@1.6.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/shade-solutions/github-mcp-plus?variant=verified)](https://m8ven.ai/mcp/shade-solutions/github-mcp-plus)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 18eaa70da6d2b8c549258f08eef38a5cea7916f4

code hash: a7c64d07558179363c0fe131d9786c04f0b7966eef8b50ace58d2714abbc540a

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client