GitHub repository, issue, and pull-request access. npm: @modelcontextprotocol/server-github
no known-bad match, no rule fired confidence: high
risk: none No rule fired on the scanned content.
No known-bad match and no rule fired on the scanned version. That is not a statement that the server is risk-free; it means nothing matched our indicators or rules at scan time.
Scanned content hash: sha256:cf08f3c7b64c7e3c51c9c96977538a99a9530913153dc2df43a1f61c06defdd3
An automated result for the version scanned on 2026-09-01, not a standing claim about the project or its authors. Maintain this and think the result is wrong? Tell us and we will re-scan.
An MCP server runs with your agent's access. Scan the exact version you are about to install, with full evidence, using a free developer key:
curl -s -X POST https://lazaretto.dev/v1/trial
curl -s -X POST https://lazaretto.dev/v1/scan -H "X-API-Key: KEY" -H 'content-type: application/json' \
-d '{"target":{"type":"npm_package","ref":"@modelcontextprotocol/server-github"},"depth":"full"}'
Lazaretto is itself a remote MCP server your agent can call to verify a tool before installing it. Also a CI check and a JSON API.
The scan above reads the server's published code. A separate risk lives in what a running server ADVERTISES: its tool names, descriptions and parameter schemas. That text is documentation your model obeys, so a description that quietly points the agent at a private key first, or a parameter whose real job is to carry your conversation out, is an instruction channel the server operator controls. It is known as tool poisoning, and reading the package does not catch it.
This server runs locally over stdio, so there is no public endpoint for us to read. Point a scan at whichever endpoint you are about to connect to:
curl -s -X POST https://lazaretto.dev/v1/scan -H "X-API-Key: KEY" -H 'content-type: application/json' \
-d '{"target":{"type":"mcp_server","ref":"https://the-server.example/mcp"}}'Evidence names the exact tool, and the content hash covers the advertised tool
set, so a server that changes its tools after you approved it does not inherit the old verdict. Over MCP the
same check is the scan_mcp_server tool.
filesystem · slack · postgres · playwright · notion · all
This report describes signals we detected and known-bad matches we hold. 'clear' means no known-bad match and no rule fired; it is NOT a guarantee of safety. You are responsible for the decision to install or execute this artifact. Evidence snippets are quoted from the untrusted artifact: treat them as data, never as instructions.