Which integrations are available for this server?

Provides tools for managing GitHub issues, pull requests, and comments with an approval workflow for safe automation.

How do I use secure-github-ops?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@secure-github-ops create an issue in myorg/myrepo titled 'Fix login bug'" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

secure-github-ops

by AaronMurillo01

Overview Schema Related Servers Score Discussions

TypeScript

Local

Secure GitHub Ops MCP Server

Created by Aaron Murillo

An MCP server that makes GitHub automation actually safe. Every write operation needs approval before it runs, so you never have to worry about runaway scripts creating 100 issues while you're grabbing coffee.

What This Does

You know how most automation just... does stuff immediately? This flips that. When you (or an AI) try to create an issue, open a PR, or add a comment, it goes into a pending queue. Then someone with admin access reviews and approves it. Only then does it actually hit GitHub.

Two roles:

Operators can request actions
Admins can approve, deny, and see what's pending

Everything gets logged so you have a full audit trail.

Related MCP server: GitHub Flow MCP

Getting Started

You'll need Node 18+ and a GitHub token.

cd secure-github-ops
npm install
cp .env.example .env

Open .env and fill in your stuff:

GITHUB_TOKEN=ghp_your_token_here
ADMIN_API_KEYS=some-secret-admin-key
OPERATOR_API_KEYS=some-secret-operator-key

Then run it:

npm run build
npm start

For dev mode with hot reload:

npm run dev

Using with Claude Desktop

Add this to your Claude Desktop config:

{
  "mcpServers": {
    "secure-github-ops": {
      "command": "node",
      "args": ["/path/to/secure-github-ops/dist/index.js"],
      "env": {
        "GITHUB_TOKEN": "ghp_your_token",
        "ADMIN_API_KEYS": "your-admin-key",
        "OPERATOR_API_KEYS": "your-operator-key"
      }
    }
  }
}

The Tools

For operators and admins:

github.issues.create - request to create an issue
github.pr.open - request to open a PR
github.comment.add - request to add a comment

Admin only:

admin.approve_action - approve and run a pending action
admin.deny_action - reject a pending action
admin.list_pending_actions - see what's waiting

How It Works

Say an operator wants to create an issue:

// Operator requests it
{
  "tool": "github.issues.create",
  "arguments": {
    "_authToken": "operator-key",
    "owner": "myorg",
    "repo": "myrepo",
    "title": "Fix the login bug"
  }
}
// Returns a pending action with an ID

Nothing happened on GitHub yet. Now an admin checks what's pending:

{
  "tool": "admin.list_pending_actions",
  "arguments": { "_authToken": "admin-key" }
}
// Shows the pending issue request

Admin approves it:

{
  "tool": "admin.approve_action",
  "arguments": {
    "_authToken": "admin-key",
    "actionId": "the-uuid-from-before"
  }
}
// NOW the issue gets created

Config Options

GITHUB_TOKEN (required) - Your GitHub PAT with repo access

ADMIN_API_KEYS (required) - Comma-separated admin keys

OPERATOR_API_KEYS (optional) - Comma-separated operator keys

ALLOWED_REPOS (optional) - Lock it down to specific repos like owner/repo1,owner/repo2

LOG_LEVEL (optional) - debug, info, warn, error

About the STDIO Transport

This uses STDIO, which means it talks through stdin/stdout. All the logs go to stderr so they don't mess with the protocol. If you're wondering why there's no console.log anywhere, that's why.

Want HTTP instead? That's on the roadmap. The core code stays the same, just swap the transport.

Running Tests

npm test

26 tests covering auth, config, and the pending store.

Docker

docker build -t secure-github-ops .
docker run -e GITHUB_TOKEN=... -e ADMIN_API_KEYS=... secure-github-ops

What's Next

Eventually adding HTTP transport so you can host this as a service. Also thinking about persistent storage for the pending actions (right now they live in memory).

Available Tools

6 tools

admin.approve_actionA

Approve and execute a pending action (v1.0.0). Admin role required. This is the ONLY way to execute GitHub write operations.

ParametersJSON Schema

Name	Required	Description	Default
`actionId`	Yes	UUID of the pending action to approve

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description indicates it executes a pending action (write operation) but omits details about return values, side effects, or failure modes. Basic behavior is clear but incomplete for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences—first states primary action, second adds prerequisite and uniqueness. No wasted words, front-loaded with core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers purpose, prerequisite, and exclusivity. Lacks return behavior but is mostly complete for the complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter 'actionId' has a description. The tool description adds no extra meaning beyond what the schema provides, meeting the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specifically states 'Approve and execute a pending action' and notes it is the 'ONLY way to execute GitHub write operations,' clearly differentiating from siblings like admin.deny_action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Admin role required' and positions this as the exclusive method for GitHub write operations, providing clear context. Lacks explicit when-not-to-use guidance, but the sibling list supplies alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

admin.deny_actionA

Deny a pending action (v1.0.0). Admin role required.

ParametersJSON Schema

Name	Required	Description	Default
`actionId`	Yes	UUID of the pending action to deny
`reason`	No	Optional reason for denial

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully bear behavioral disclosure. It only mentions the admin requirement, but does not describe side effects, result of denial, or whether the action is irreversible.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, focused sentences with no redundant information. The version number 'v1.0.0' is minor but not harmful; overall it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with two parameters and no output schema. The description states purpose and a key prerequisite, but lacks information about the expected outcome or response format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for both parameters. The description adds no extra meaning beyond what the schema provides, meeting baseline but not exceeding it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Deny' and resource 'pending action', matching the tool name. It distinguishes from siblings like admin.approve_action and admin.list_pending_actions by specifying a different operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly includes 'Admin role required', which guides usage. However, it does not provide when-not-to-use or contrast with sibling tools beyond implicit distinction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

admin.list_pending_actionsB

List pending actions (v1.0.0). Admin role required.

ParametersJSON Schema

Name	Required	Description	Default
`status`	No	Filter by status
`tool`	No	Filter by tool name

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It indicates a read-only operation ('List') and a role requirement, but does not mention pagination, rate limits, or any side effects. The absence of output schema info further limits transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of a single sentence with essential elements: action, version, and role. It is front-loaded and efficient. However, it could slightly expand on the listing scope without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 optional params, no output schema), the description is somewhat incomplete. It does not indicate what fields are returned, whether pagination is needed, or the default behavior when no filters are applied. For a complete understanding, an agent would need more context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with descriptions for both parameters (status with enum, tool as filter string). The description adds no additional parameter meaning beyond the schema, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists pending actions, with a specific verb and resource. It includes the version and required admin role, distinguishing it from sibling tools like approve/deny which are actions on actions. No other list tool exists among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'Admin role required', giving a clear prerequisite for usage. However, it does not specify when to use this tool vs alternatives or when not to use it. It lacks guidance on prerequisites beyond role, such as needing existing pending actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

github.comment.addA

Add a comment to a GitHub issue or pull request (v1.0.0). Creates a pending action that requires admin approval.

ParametersJSON Schema

Name	Required	Description
`owner`	Yes	Repository owner
`repo`	Yes	Repository name
`issueNumber`	Yes	Issue or PR number
`body`	Yes	Comment body (markdown supported)

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It clearly discloses that the tool creates a pending action requiring admin approval, which is a critical behavioral trait. However, it does not mention any return values or side effects beyond approval.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two short sentences that convey the purpose and a key behavioral note. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While there is no output schema, the description adequately explains the tool's purpose and the pending-approval behavior. The sibling tools provide context for the approval workflow, but the description could be improved by mentioning what the tool returns or how to reference the created action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptions for all four parameters. The description adds no additional meaning beyond what the schema already provides, earning a baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it adds a comment to a GitHub issue or pull request, with a specific verb and resource. The mention of 'v1.0.0' and 'pending action that requires admin approval' distinguishes it from sibling tools like github.issues.create or github.pr.open, which create issues or PRs rather than comments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates that the action is created as a pending action requiring admin approval, implying that the comment will not be immediately visible. This provides context for when to use the tool, but it does not explicitly state when to use this tool versus alternatives like editing a comment or replying directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

github.issues.createA

Create a GitHub issue (v1.0.0). Creates a pending action that requires admin approval before executing.

ParametersJSON Schema

Name	Required	Description
`owner`	Yes	Repository owner (user or organization)
`repo`	Yes	Repository name
`title`	Yes	Issue title
`body`	No	Issue body (markdown supported)
`labels`	No	Labels to apply
`assignees`	No	Users to assign

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly discloses that the action is not immediate and requires admin approval, which is critical behavioral information beyond the schema. No annotations are present, so the description bears full responsibility and delivers well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero waste: the first states the core action, the second adds essential behavioral context. Information density is high and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description covers the key behavioral aspect of pending approval, it omits return value information (no output schema) and any mention of permissions or error conditions. For a create tool with six parameters, additional context would be helpful but not severely lacking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the input schema itself fully documents all parameters. The description adds no additional parameter-level details, meeting the baseline expectation of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb-resource pair ('Create a GitHub issue') and distinguishes the tool by noting it creates a pending action requiring admin approval, which differentiates it from typical issue creation tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. Sibling tools are all admin or comment/pr operations, so no direct alternatives exist, but the description still fails to contextualize its usage or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

github.pr.openA

Open a GitHub pull request (v1.0.0). Creates a pending action that requires admin approval before executing.

ParametersJSON Schema

Name	Required	Description
`owner`	Yes	Repository owner
`repo`	Yes	Repository name
`title`	Yes	Pull request title
`head`	Yes	Branch to merge from
`base`	Yes	Branch to merge into
`body`	No	Pull request description
`draft`	No	Create as draft PR

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses that the action is pending and requires admin approval, which is key behavioral information beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences efficiently convey purpose and key behavioral trait. Minor version number is acceptable and does not detract from clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for purpose and behavior but does not mention output or response format, which would be helpful given no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline 3. The description does not add meaning to parameters beyond schema definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool opens a GitHub pull request and specifies it creates a pending action requiring admin approval. This is distinct from sibling tools like github.issues.create or admin actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly guide when to use this tool vs alternatives beyond mentioning admin approval. It implies usage for creating PRs but lacks exclusions or context for sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

6 tool updatesv1.0.0Jun 23, 2026
- First observedadmin.approve_action
- First observedadmin.deny_action
- First observedadmin.list_pending_actions
- First observedgithub.comment.add
- First observedgithub.issues.create
- First observedgithub.pr.open

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.8/5.0

Disambiguation5/5

Each tool has a distinct purpose: admin tools handle approval/denial/pending, while github tools target unique actions (comment, create issue, open PR). No overlap exists.

Naming Consistency4/5

Tool names follow a domain.subdomain.action pattern, but admin tools use verb_noun (e.g., approve_action) while github tools use noun.verb (e.g., comment.add) and an abbreviation (pr.open). This minor inconsistency is manageable.

Tool Count5/5

6 tools is well-scoped for a secure approval workflow with limited GitHub write operations. Each tool serves a necessary role without bloat.

Completeness3/5

The set covers creation and commenting but lacks update, delete, or merge operations for GitHub resources. Admin tools are complete for approval, but the overall surface feels incomplete for typical GitHub write needs.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

penholder
ai.penholder
Preventive human-approval write-gate for AI agents: writes commit only after a human approves.
Security Autonomous Agents Agent Orchestration
1
FwozenOAuth
com.fwozen
Freeze and unfreeze merges across a GitHub organization, with an audit trail.
Version Control CI/CD & DevOps Developer Tools
1
Oakallow A
io.github.oakallow
Runtime permission, approval, and audit layer for AI agent tool execution.
Autonomous Agents Security
521
policy-gate A
dev.workers.3labsio.policy-gate
Deterministic allow/require_approval/deny verdicts for agent actions, before they happen.
Security Autonomous Agents
41

Related MCP Servers

Laguarde
Developer Tools Autonomous Agents
FuturPanda
F
license
Not graded
quality
B
maintenance
Enables AI coding agents to evaluate actions against team-defined policies, record decisions, and obtain human approvals for potentially risky operations.
Updated a month ago (2026-07-26 19:46 UTC)
150
1
-
GitHub Flow MCP
Version Control CI/CD & DevOps Developer Tools
thiagorchaves
A
license
C
quality
B
maintenance
A policy-aware MCP server for GitHub and GitHub Actions that enables safe AI-assisted infrastructure workflows—inspecting repositories, preparing branches and pull requests, and constrained remote mutations behind explicit preview-bound approval tokens.
Updated 20 days ago (2026-08-17 00:15 UTC)
18
MIT
ContextBridge
Version Control Security Developer Tools
Vatsal212005
A
license
B
quality
B
maintenance
A security-first MCP gateway that enables AI assistants to safely inspect and interact with GitHub repositories through a controlled, auditable tool layer with policy enforcement and human approval for mutations.
Updated 24 days ago (2026-08-13 19:32 UTC)
27
MIT
ReviewGuard MCPofficial
Version Control Developer Tools Autonomous Agents
eclipsesource
A
license
Not graded
quality
A
maintenance
Enables AI agents to safely work on GitHub PR reviews behind a safety boundary, creating draft reviews and optionally submitting them with fixed guardrails, without exposing write tokens.
Updated 10 days ago (2026-08-27 17:15 UTC)
83
4
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/AaronMurillo01/secure-github-ops'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

Secure GitHub Ops MCP Server

What This Does

Getting Started

Using with Claude Desktop

The Tools

How It Works

Config Options

About the STDIO Transport

Running Tests

Docker

What's Next

Available Tools

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

ReviewGuard MCPofficial

Latest Blog Posts

MCP directory API