Verified Security Benchmark Report
github/github-mcp-server
Scanned at Tue, 03 Nov 2026 19:43:50 GMT • MCP Spec: Unknown • Ephemeral execution sandbox.
Security Grade
B
Score: 83 / 100
Official Verification Badge for README.md
[](https://adalab.cc/audit/github/github-mcp-server)Copy and paste this markdown snippet into your GitHub repository README to display live verification status to users and security reviewers.
Schema Conformance
90%
Tool Containment
88%
Token & Secret Safety
70%
Fuzz Resilience
85%
Security & Conformance Diagnostics (1)
high[ADA-SEC-002]
.github/workflows/pr-triage.mdDirect User Input Concatenation into System Context
Unsanitized user parameters appear to be interpolated directly into prompts in .github/workflows/pr-triage.md. This exposes the agent to indirect prompt injection and behavioral hijack.
Remediation: Isolate user inputs within delimited tags (e.g. `<user_data>...</user_data>`) and configure system-level guardrails.
Automate this Security Gate in CI/CD
Run AdaLab on Every Pull Request for github/github-mcp-server
Install our official 3-line GitHub Action. Block vulnerable code before merging, receive Slack/Discord alerts, and ensure your badge stays green.