[mcp-tools-report] GitHub MCP Remote Server Tools Report — 2026-07-05

[github-actions[bot]]

Generated: 2026-07-05 · MCP Mode: Remote · Toolsets: All · Previous Report: 2026-06-28

Discovery note: GitHub MCP tools were not exposed as callable functions this run, so live self-inspection was not possible. This report uses the last read-only snapshot (cache-memory/github-mcp-tools.json, 2026-06-28, 58 read-only tools) as the discovered set, cross-referenced against github_toolsets_permissions.json. External source verification (WebFetch/WebSearch) was not permitted this session.

Executive Summary

• Discovered (read-only): 58 tools · Full mapping (incl. writes): 93 tools / 24 toolsets
• Source: github_toolsets_permissions.json · Instructions: .github/aw/github-mcp-server.md
• Changes since last report: None — New 0 · Removed 0 · Unchanged 58 (no live re-enumeration this run)

Bottom line: ✅ JSON mapping is consistent with the discovered set once read-only exclusions are accounted for. No JSON change / no PR warranted.

Inconsistency Detection

• Duplicate tools: none · Orphaned tools: none · Miscategorized: none confirmed
• Naming: mixed verb-noun (list_issues) vs consolidated noun_action (issue_read, pull_request_read, actions_get) — matches upstream, expected.
• Cross-file note: github_tool_to_toolset.json places search_code and list_starred_repositories under repos, whereas github_toolsets_permissions.json uses search and stargazers. Minor internal inconsistency (not a server issue).
• Empty toolset: users has an empty tools array while search_users lives under search.

JSON Mapping Comparison

• Real discrepancies: 0 · Extra (discovered∉JSON): 0 · Genuine moves: 0
• Missing (JSON∉discovered): 35 — all expected (write ops + auth-gated reads not exposed to a read-only integration-token session: context.get_me/get_teams/get_team_members, copilot.*, experiments.*, users empty, get_file_blame, and all *_write/create/update/delete/merge/fork/push/star tools).

Two "moved-looking" cases are read-only listing artifacts, not real moves

Tool	Read-only listed under	Authoritative (JSON + tool map)
search_issues	issues_search group	issues
search_pull_requests	search	pull_requests

Both repo data files already agree on the authoritative column → no update made.

Action: No updates needed — no pull request created.

Changes Since Last Report

No tools added, removed, or moved since 2026-06-28.

Tools by Toolset

Read+write shown; ✍️ = write, 🔒 = auth-gated (both absent from the read-only session). Sources are files in github-mcp-server/pkg/github.

Core — context, repos, issues, pull_requests, actions

• context (context_tools.go): get_me🔒, get_teams🔒, get_team_members🔒
• repos (repositories.go): get_file_contents, get_commit, list_commits, list_branches, list_tags, get_tag, list_releases, get_latest_release, get_release_by_tag, list_repository_collaborators, get_file_blame🔒, create_branch✍️, create_or_update_file✍️, delete_file✍️, push_files✍️, create_repository✍️, fork_repository✍️
• issues (issues.go): issue_read, list_issues, list_issue_fields, list_issue_types, search_issues, issue_write✍️, add_issue_comment✍️, sub_issue_write✍️
• pull_requests (pullrequests.go): pull_request_read, list_pull_requests, search_pull_requests, create_pull_request✍️, update_pull_request✍️, merge_pull_request✍️, update_pull_request_branch✍️, pull_request_review_write✍️, add_comment_to_pending_review✍️, add_reply_to_pull_request_comment✍️
• actions (actions.go): actions_get, actions_list, get_job_logs, actions_run_trigger✍️

Security — code_security, code_quality, dependabot, secret_protection, security_advisories

• code_security (code_scanning.go): list_code_scanning_alerts, get_code_scanning_alert
• code_quality: get_code_quality_finding
• dependabot (dependabot.go): list_dependabot_alerts, get_dependabot_alert
• secret_protection (secret_scanning.go): list_secret_scanning_alerts, get_secret_scanning_alert, run_secret_scanning
• security_advisories (security_advisories.go): list_global_security_advisories, get_global_security_advisory, list_repository_security_advisories, check_dependency_vulnerabilities

Collaboration — discussions, gists, labels, notifications, projects

• discussions (discussions.go): list_discussions, get_discussion, list_discussion_categories, get_discussion_comments, discussion_comment_write✍️
• gists (gists.go): list_gists, get_gist, create_gist✍️, update_gist✍️
• labels (labels.go): list_label, get_label, label_write✍️
• notifications (notifications.go): list_notifications, get_notification_details, dismiss_notification✍️, mark_all_notifications_read✍️, manage_notification_subscription✍️, manage_repository_notification_subscription✍️
• projects (projects.go, needs PAT): projects_list, projects_get, projects_write✍️

Search / org / misc — search, orgs, users, stargazers, git, experiments, copilot, copilot_spaces, github_support_docs_search

• search (search.go): search_code, search_commits, search_repositories, search_orgs, search_users, semantic_issues_search, semantic_issue_similarity_search
• orgs: list_org_repository_security_advisories
• users: (empty in mapping)
• stargazers (repositories.go): list_starred_repositories, star_repository✍️, unstar_repository✍️
• git: get_repository_tree
• experiments (dynamic_tools.go): list_available_toolsets, get_toolset_tools, enable_toolset
• copilot: assign_copilot_to_issue✍️, request_copilot_review✍️
• copilot_spaces (remote-only): list_copilot_spaces, get_copilot_space
• github_support_docs_search (remote-only): github_support_docs_search

Recommended Default Toolsets

Defaults: context, repos, issues, pull_requests, users

• context — identity, near-zero risk · repos — most-used surface · issues/pull_requests — core collaboration objects · users — cheap profile lookups.

Enable explicitly: actions (CI); code_security/code_quality/dependabot/secret_protection/security_advisories (security review); discussions/gists/labels/notifications/projects (object-specific); search/orgs/stargazers/git (lookups); experiments, copilot, copilot_spaces, github_support_docs_search (niche/remote-only).

Toolset Configuration Reference

tools:
  github:
    mode: "remote"   # or "local"
    toolsets: [all]  # or e.g. [context, repos, issues, pull_requests]

Notes & Methodology

• Mapping (v2.2) is well-maintained and consistent with the discovered set once write/auth-gated tools are excluded.
• Maintainer items (no PR this run): (1) github_tool_to_toolset.json vs github_toolsets_permissions.json disagree on search_code and list_starred_repositories; (2) empty users toolset while search_users sits under search.
• Method: read-only snapshot (2026-06-28) — live enumeration unavailable (MCP tools not callable; WebFetch/WebSearch denied); cross-referenced against local repo data files. Source: github/github-mcp-server.

References: §28741234846

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 GitHub MCP Remote Server Tools Report Generator · 154 AIC · ⌖ 17.9 AIC · ⊞ 10.5K · ◷

• expires on Jul 8, 2026, 4:55 AM UTC-08:00