Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

GitHub Code Scanning (BYOK) — connector documentation

  • MCP endpoint: https://byok-github-code-scanning.connectorbay.com/mcp
  • REST API: POST https://byok-github-code-scanning.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-github-code-scanning.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own GitHub Code Scanning GitHub personal access token (security_events scope, or repo scope), sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-github-code-scanning.connectorbay.com/health · Tool schemas: https://byok-github-code-scanning.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-github-code-scanning · agent@connectorbay.com

What GitHub Code Scanning (BYOK) is for

GitHub Code Scanning (BYOK) lets an AI assistant read your own GitHub Code Scanning data through the GitHub Code Scanning API with a key you supply (GitHub personal access token (security_events scope, or repo scope)). Read-only: 7 tools (list_org_code_scanning_alerts, list_code_scanning_analyses, get_code_scanning_analysis, list_alert_instances, get_default_setup, list_codeql_databases, get_sarif_upload_status). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.github.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Code Scanning. GitHub Code Scanning and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which open high-severity code scanning alerts does octo-org have?"
  • "When did CodeQL last analyze octocat/Hello-World and how many results did it find?"
  • "Describe code scanning analysis 201 of octocat/Hello-World"
  • "Where does code scanning alert 4 of octocat/Hello-World occur?"
  • "Is code scanning default setup turned on for octocat/Hello-World?"
  • "Which CodeQL databases exist for octocat/Hello-World?"

What it does

  • list_org_code_scanning_alerts: List code scanning alerts across all repositories of an organization with rule, severity, state, tool and repository; filter by state, severity or tool.
  • list_code_scanning_analyses: List recent code scanning analyses of a repository (one per tool run and ref) with commit, category, result and rule counts.
  • get_code_scanning_analysis: Get one code scanning analysis by its numeric ID: tool and version, ref, commit, category, result and rule counts, errors and warnings.
  • list_alert_instances: List where a code scanning alert occurs: ref, commit, file path, line range, state and message for each instance.
  • get_default_setup: Get a repository's code scanning default setup: whether it is configured, the languages, query suite, runner type and schedule.
  • list_codeql_databases: List the CodeQL databases stored for a repository with language, size, commit and update time.
  • get_sarif_upload_status: Check whether an uploaded SARIF file has finished processing (pending, complete or failed) and list any processing errors.

BYOK key

You bring your own GitHub Code Scanning GitHub personal access token (security_events scope, or repo scope) (https://github.com/settings/tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.github.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the GitHub Code Scanning API (api.github.com) with a BYOK key; documentation: https://docs.github.com/en/rest/code-scanning/code-scanning. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Code Scanning. GitHub Code Scanning and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your GitHub Code Scanning account.

Built for: Worldwide. Languages: English.