GitHub MCP
An official MCP Server implementation provided by GitHub that enables AI applications to access GitHub repositories via the Model Context Protocol (MCP). It supports operations such as browsing repository contents, reading issues, and handling pull requests.
Timeline (last 90 days)
During the attack, the GitHub MCP server was not compromised or malfunctioned, but instead operated normally as designed and executed operations within the scope of agent-authorized permissions.
Invariant Labs demonstrated an attack against the official GitHub MCP server: after planting a malicious issue in a public repository, the agent pulled data from the repository owner's private repositories and published it to a public pull request.
An agent can perform both read and write operations—such as reading and creating issues—through the same GitHub MCP tool.
CoverCraft pulls the actual commit history of the user's public repositories via the GitHub MCP tool, anchoring capability claims to specific commit hashes
mcp-server-git provides Git repository operation capabilities, enabling models to read and interact with code version control systems.
All Facts (5)
During the attack, the GitHub MCP server was not compromised or malfunctioned, but instead operated normally as designed and executed operations within the scope of agent-authorized permissions.
50%UnverifiedAn agent can perform both read and write operations—such as reading and creating issues—through the same GitHub MCP tool.
50%UnverifiedCoverCraft pulls the actual commit history of the user's public repositories via the GitHub MCP tool, anchoring capability claims to specific commit hashes
50%Unverifiedmcp-server-git provides Git repository operation capabilities, enabling models to read and interact with code version control systems.
50%UnverifiedInvariant Labs demonstrated an attack against the official GitHub MCP server: after planting a malicious issue in a public repository, the agent pulled data from the repository owner's private repositories and published it to a public pull request.
50%