GitHub MCP Server 1.10.0

Highlights

v1.10.0 is a substantial security, reliability, and compatibility release for the GitHub MCP Server.

Safer by default

• Added confirmed repository deletion with form elicitation and protected multi-round-trip state (#3076).
• Restricted bearer credentials to configured GitHub authorities (#3056).
• Enforced HTTPS for GitHub Enterprise hosts (#3069).
• Made invalid static --tools configuration fail closed (#3050).
• Hardened lockdown, request limits, cache isolation, URL traversal, and response sanitization (#3109, #3112, #3113, #3111, #3108, #3114, #3110).

Better GitHub Enterprise Server compatibility

• list_issues and search_issues now degrade safely when issue custom-field GraphQL types are unavailable (#3086, #2897).
• list_issues now returns assignee logins and stable empty arrays for unassigned issues (#3064).
• Validation failures expose safe ruleset details when supplied by the GitHub API (#3081).

Safer repository file operations

• get_file_contents now identifies symbolic links and clearly labels dereferenced content.
• Symbolic-link writes require explicit allow_symlink_write: true opt-in (#3071).
• Fixed binary MCP resources being base64-encoded twice (#3098).

More reliable tool contracts

• Corrected add_issue_comment input modes (#3085).
• issue_write.issue_fields[].delete: false is now a valid no-op for strict-schema clients (#3077).
• Zero-parameter tools accept an omitted arguments property while rejecting explicit null and malformed JSON (#3099).
• Notification subscription tools explicitly advertise destructive behavior (#2936).
• Copilot review-request denials now return actionable guidance instead of a bare 404 (#3119).

Projects, Actions, and efficiency

• Added Project view lifecycle operations and visible-field configuration (#2961, #2988).
• Reduced Actions and other successful response payloads (#3047, #3055).
• Improved sanitization performance and refreshed UI/build dependencies (#3120, #3100).

Behavior changes to note

• Unknown static --tools names now prevent startup.
• Symbolic-link updates require explicit opt-in.
• Requests cannot relax server-enforced lockdown.
• Oversized HTTP request bodies are rejected early.
• add_issue_comment performs stricter mutually exclusive mode validation.
• Repository deletion requires an eligible modern MCP client, form elicitation support, and the appropriate scopes.

What's Changed

• Reduce Actions workflow list response payloads by @tommaso-moro in #3047
• Use minimal response types for tool results by @tommaso-moro in #3055
• Add basic project view management by @zwick in #2961
• Add visible fields to project views by @zwick in #2988
• fix(actions): avoid malformed response on log download failure by @SamMorrowDrums in #3066
• fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials by @SamMorrowDrums in #3069
• Reject unsupported subscription streams by @SamMorrowDrums in #3073
• build(deps): bump distroless/base-debian12 from 348dac1 to 76b3162 by @dependabot[bot] in #3088
• build(deps): bump golang from 1.25.12-alpine to 1.25.13-alpine by @dependabot[bot] in #3087
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #3089
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #3007
• build(deps): bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in #3005
• Add confirmed repository deletion tool by @SamMorrowDrums in #3076
• fix(issues): validate add_issue_comment input modes by @SamMorrowDrums in #3085
• Fix static --tools validation fallback by @Mahmoud772122777 in #3050
• Attach GitHub token only to configured GitHub hosts by @SyedAnas01 in #3056
• Show ruleset violation details when create_branch fails by @Hashim1999164 in #3081
• fix(notifications): mark subscription tools destructive by @SamMorrowDrums in #2936
• Fix binary resource blob encoding by @SamMorrowDrums in #3098
• Return assignees from list_issues by @tgockel in #3064
• Fix list_issues on GHES schemas without issue fields by @SamMorrowDrums in #3086
• Fix omitted tool arguments by @SamMorrowDrums in #3099
• Clarify symlink behavior for repository file reads and writes by @theinfosecguy in #3071
• fix(issues): allow delete:false in issue_write issue_fields by @tgockel in #3077
• Handle unsupported issueFieldValues enrichment in search_issues by @kerobbi in #2897
• build(deps): clear UI dependency alerts by @SamMorrowDrums in #3100
• fix(lockdown): harden pull_request_read get_commits handling by @SamMorrowDrums in #3109
• fix(http): make server lockdown mode an upper bound over requests by @SamMorrowDrums in #3112
• Centralize sanitization of untrusted GitHub response fields by @SamMorrowDrums in #3114
• Filter invisible Unicode after HTML entity normalization by @SamMorrowDrums in #3110
• fix(raw): reject traversal segments when constructing raw content URLs by @SamMorrowDrums in #3108
• refactor: condense lockdown comments in GetPullRequestCommits by @SamMorrowDrums in #3115
• Limit HTTP request bodies before MCP middleware parsing by @SamMorrowDrums in #3111
• fix(lockdown): isolate repo-access cache per caller identity by @SamMorrowDrums in #3113
• perf(sanitize): make clean text allocation-free on the hot path by @SamMorrowDrums in #3120
• test(sanitize): drop the optimization scaffolding by @SamMorrowDrums in #3121
• fix(copilot): explain review request denials instead of forwarding a bare 404 by @dylanpulver in #3119
• build(deps): bump the npm_and_yarn group across 1 directory with 4 updates by @dependabot[bot] in #3091

New Contributors

• @Mahmoud772122777 made their first contribution in #3050
• @SyedAnas01 made their first contribution in #3056
• @Hashim1999164 made their first contribution in #3081
• @tgockel made their first contribution in #3064
• @theinfosecguy made their first contribution in #3071
• @dylanpulver made their first contribution in #3119

Full Changelog: v1.9.0...v1.10.0