MCP compliance catalog

Reads metadata for a workflow, workflow run, or job.

Lists workflows, workflow runs, or jobs in a repository.

Triggers a workflow_dispatch or rerun event; executes CI with configured secrets and can affect deployment pipelines.

Adds a draft comment to an in-progress pull request review.

Posts a comment on an issue; visible to repository collaborators.

Replies to an existing pull request review comment.

Assigns the GitHub Copilot coding agent to an issue.

Creates a new branch in the repository; pre-condition for direct-write workflows that bypass PR review.

Creates a gist; gists are public by default and have repeatedly been a leak vector for secrets and customer data.

Writes file content directly to a branch; combined with merge_pull_request, this lets an agent ship code without going through PR review.

Opens a pull request proposing changes; review and merge gating remain in place.

Delegates code authorship to Copilot and opens a PR; the resulting PR still passes through normal branch-protection review, but the human-in-the-loop boundary moves from 'wrote the code' to 'approved the PR.'

Creates a new repository in an org or user account; standard provisioning event.

Removes a file from a branch via direct commit; reversible from history but bypasses PR review when used outside a feature branch.

Marks a single notification as read or done for the caller.

Creates a fork of an existing repository under the caller's account or org.

Reads details of a code scanning alert, including vulnerable code locations and exploit hints.

Reads metadata and diff for a single commit.

Reads a Copilot Space configuration; returns the context the space exposes to Copilot.

Reads details of a Dependabot dependency vulnerability alert.

Reads a single discussion thread.

Reads comments on a discussion thread.

Reads the contents of a file at a given ref; private repo contents may include source code and configuration.

Reads a single gist by id.

Reads a public global security advisory from the GitHub Advisory Database.

Reads workflow job logs; logs frequently leak environment values, tokens, and connection strings.

Reads a single label definition.

Reads the metadata of the most recent release for a repository.

Reads the authenticated user's profile.

Reads details of a single notification thread.

Reads release metadata for a specific tag.

Reads the git tree (file listing) for a repository at a given ref.

Reads a secret scanning alert; the alert payload may include the leaked secret value or a partial fingerprint.

Reads tag metadata for a repository.

Lists members of an organization team; returns identifiable user data.

Lists teams in an organization; returns team membership and slug data.

Searches GitHub's public product and support documentation; read-only over public material.

Reads issue details and comments; private repository issues may contain customer-reported PII or security details.

Creates or updates an issue (title, body, assignees, state).

Creates, updates, or removes a label on a repository.

Lists branches in a repository.

Enumerates code scanning alerts across a repository; surfaces unpatched vulnerabilities to the caller.

Lists commits on a branch or path; surfaces author identity and timestamps.

Enumerates Copilot Spaces visible to the caller; metadata-only.

Enumerates open Dependabot alerts; surfaces the unpatched dependency surface to the caller.

Lists discussion categories configured on a repository.

Lists discussion threads on a repository.

Lists gists for the authenticated user.

Lists public global security advisories.

Lists configured issue types for an organization.

Lists issues on a repository or for the caller.

Lists labels defined on a repository.

Lists the caller's GitHub notifications.

Lists security advisories across an organization's repositories, including private/draft advisories.

Lists pull requests on a repository.

Lists releases for a repository.

Lists security advisories on a single repository, including private/draft advisories.

Enumerates secret scanning alerts; an attacker reading this list can prioritize live credentials to harvest.

Lists repositories the caller or another user has starred.

Lists tags for a repository.

Updates the caller's subscription state for a single notification thread.

Updates the caller's subscription state for an entire repository.

Marks all of the caller's notifications as read.

Integrates a pull request into the target branch; for financial-system repositories this is in scope for SOX ITGCs and change-management controls.

Reads metadata for a Projects v2 board, item, or field.

Lists Projects v2 boards or items accessible to the caller.

Creates, updates, or removes Projects v2 items, fields, or status; standard planning-board write.

Reads pull request details, diffs, comments, and review state.

Commits a batch of file changes directly to a branch; combined with merge_pull_request, this enables ship-without-review.

Requests an AI Copilot code review on a pull request; review verdict is advisory and does not satisfy required-reviewer rules.

Searches code across accessible repositories; can surface secrets, credentials, or PII at scale and constitutes a data-exfiltration vector.

Searches issues across accessible repositories; can surface PII reported in issue bodies at scale.

Searches GitHub organizations by name or attribute.

Searches pull requests across accessible repositories.

Searches repositories by name, description, or topic.

Searches GitHub users by login, name, or email; returns identifiable PII at scale.

Adds a star on a repository as the authenticated user.

Creates, links, or removes a sub-issue parent/child relationship.

Removes a star on a repository as the authenticated user.

Updates an existing gist; public gists remain a leak surface for secrets and customer data.

Updates pull request metadata such as title, body, base branch, or assignees.

Updates a PR head branch with the latest from base; rewrites branch state and can mask in-flight review feedback in change-controlled repos.