repoward

A GitHub MCP server that stops AI agents acting on what an attacker's issue told them to do.

Status: alpha. It has not had an independent security review. Read the threat model, especially the part about where it runs.

The problem

An agent with GitHub access can read a malicious public issue, read a private repository, and post the contents in a public pull request. Each call looks allowed on its own, so per-tool permissions do not stop the sequence. This is the attack Invariant Labs published against agents using GitHub's MCP server, and repoward's test suite replays it against real repositories.

Flow guard

Before every write, repoward checks what this agent has already read, using facts from GitHub:

This does not depend on the model noticing an attack or on scanning text, so rewording or encoding the data does not get around it. The state survives restarts, and no tool can clear it. A person can:

uvx repoward flow status
uvx repoward flow reset

What it does not do:

• It only sees this server's tools. A shell, a browser or another MCP server is still a way out, so it protects agents whose GitHub access and outbound routes are limited to this server.
• Data can stay in an agent's context after the window (60 minutes by default) ends. Restart a long-running agent to clear its context.
• Reading one private repository and writing to another private repository is allowed, unless you set single_repo: true.
• Repository files and code search results do not count as untrusted input, because they were merged by someone with write access.
• author_association is a coarse signal, and a compromised trusted account counts as trusted.
• Maintainers of public repositories will see more approval requests. That is the cost of the default, and trusted_associations is configurable.

Features

• Policy: default-deny YAML with roles, repository allowlists and path denylists. See policy.example.yaml.
• Single guarded path: every tool attempt, including unknown tools and invalid arguments, passes through one pipeline and is logged.
• Audit log: a hash-chained record of every decision, with optional HMAC and checkpoints.
• Rate limits: per principal and per tool.
• Read tools: github_list_issues, github_get_issue, github_search_code, github_get_file, ci_get_status and ci_get_job_logs.
• Write tools: github_create_branch, github_commit_files, github_create_pull_request and github_comment. Writes only reach branches with the configured prefix (agent/ by default), pull requests are draft only by default, commit sizes are limited, nothing is forced or retried, and text holding a recognizable credential is refused.
• Dangerous tools: github_merge_pull_request and github_delete_branch need human approval. An approval covers one exact call at one exact commit, works once and expires. Merging is off until a policy turns it on.
• GitHub App tokens (optional): each call gets a short-lived token limited to one repository and only the permissions that tool needs, and GitHub enforces those limits itself.
• Pull request review as approval (optional): a merge can be approved by a real GitHub review of the exact commit.
• Pull request receipts (optional): a commit status summarizing how the agent's run has gone.
• HTTP mode (optional): serve several users from one server, each logging in with a JWT fr

... View full README on GitHub