Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

GitHub Dependency Graph (BYOK) — connector documentation

  • MCP endpoint: https://byok-github-dependency-graph.connectorbay.com/mcp
  • REST API: POST https://byok-github-dependency-graph.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-github-dependency-graph.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own GitHub Dependency Graph GitHub personal access token (repo scope; admin access to the repository or organization for the Dependabot reads), sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-github-dependency-graph.connectorbay.com/health · Tool schemas: https://byok-github-dependency-graph.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-github-dependency-graph · agent@connectorbay.com

What GitHub Dependency Graph (BYOK) is for

GitHub Dependency Graph (BYOK) lets an AI assistant read your own GitHub Dependency Graph data through the GitHub Dependency Graph API with a key you supply (GitHub personal access token (repo scope; admin access to the repository or organization for the Dependabot reads)). Read-only: 6 tools (export_sbom, compare_dependencies, list_repo_dependabot_secret_names, list_org_dependabot_secret_names, list_org_secret_repositories, get_org_dependabot_repository_access). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.github.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Dependency Graph. GitHub Dependency Graph and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which packages and versions does octocat/Hello-World depend on?"
  • "What dependencies changed between v1.0 and main in octocat/Hello-World?"
  • "Which Dependabot secrets does octocat/Hello-World have configured?"
  • "Which Dependabot secrets does octo-org share with its repositories?"
  • "Which repositories can use the NPM_TOKEN Dependabot secret in octo-org?"
  • "Which of octo-org's repositories can Dependabot reach?"

What it does

  • export_sbom: Export a repository's software bill of materials in SPDX form: document name, creation time and the list of packages with versions and licenses. Large repositories may be cut short.
  • compare_dependencies: Show the dependencies added, removed or changed between two commits (base...head) with ecosystem, version, license and known vulnerabilities.
  • list_repo_dependabot_secret_names: List the names and dates of a repository's Dependabot secrets (values are never available).
  • list_org_dependabot_secret_names: List the names, dates and visibility of an organization's Dependabot secrets (values are never available).
  • list_org_secret_repositories: List the repositories that can use one named organization Dependabot secret (for secrets shared with selected repositories).
  • get_org_dependabot_repository_access: Show which repositories Dependabot may access in an organization, and the default access level.

BYOK key

You bring your own GitHub Dependency Graph GitHub personal access token (repo scope; admin access to the repository or organization for the Dependabot reads) (https://github.com/settings/tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.github.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the GitHub Dependency Graph API (api.github.com) with a BYOK key; documentation: https://docs.github.com/en/rest/dependency-graph. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Dependency Graph. GitHub Dependency Graph and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your GitHub Dependency Graph account.

Built for: Worldwide. Languages: English.