Unverified50% confidenceFactExact time
Invariant Labs pointed out that there is no bug in the GitHub MCP server code itself — it is the combination of capabilities that constitutes the vulnerability.
1
Sources
50%
Confidence
Long-term
Relevance
10/8/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPerplexity sometimes gives answers implying it did not use the connector at all even when the GitHub connector is selected, and does not explicitly inform the user whether the connector call failed.69% similarVerifiedAPI keys should not be hard-coded in source code and pushed to public code repositories such as GitHub.67% similarUnverifiedSWE-bench使用真实GitHub Issue评测代码能力，但仍是离线静态评估，无法模拟真实Agent任务中的网络延迟、API变更等动态因素66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/988954API
curl https://kongchang.com/api/v1/knowledge/claims/988954MCP
get_claim(id=988954)