Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

GitHub Secret Scanning (BYOK) — connector documentation

  • MCP endpoint: https://byok-github-secret-scanning.connectorbay.com/mcp
  • REST API: POST https://byok-github-secret-scanning.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-github-secret-scanning.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own GitHub Secret Scanning GitHub personal access token (security_events scope, or repo scope), sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-github-secret-scanning.connectorbay.com/health · Tool schemas: https://byok-github-secret-scanning.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-github-secret-scanning · agent@connectorbay.com

What GitHub Secret Scanning (BYOK) is for

GitHub Secret Scanning (BYOK) lets an AI assistant read your own GitHub Secret Scanning data through the GitHub Secret Scanning API with a key you supply (GitHub personal access token (security_events scope, or repo scope)). Read-only: 7 tools (list_org_secret_scanning_alerts, get_secret_scanning_alert, list_alert_locations, get_scan_history, list_repo_custom_patterns, list_org_custom_patterns, list_org_pattern_configurations). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.github.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Secret Scanning. GitHub Secret Scanning and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which open secret scanning alerts does octo-org have?"
  • "Describe secret scanning alert 9 of octocat/Hello-World"
  • "In which files and commits was secret scanning alert 9 of octocat/Hello-World found?"
  • "When did secret scanning last run on octocat/Hello-World?"
  • "Which custom secret patterns does octocat/Hello-World define?"
  • "Which custom secret patterns does octo-org define?"

What it does

  • list_org_secret_scanning_alerts: List secret scanning alerts across an organization with secret type, provider, state, validity and repository; the secret value is never returned.
  • get_secret_scanning_alert: Get one repository secret scanning alert: type, provider, state, resolution, validity, leak flags and push protection bypass; the secret value is never returned.
  • list_alert_locations: List where a secret scanning alert was found: file path, line and column range, and the commit and blob SHA.
  • get_scan_history: Get a repository's secret scanning scan history: incremental, pattern update, backfill and custom pattern scans with status and times.
  • list_repo_custom_patterns: List a repository's custom secret scanning patterns with name, state, push protection flag and version; the pattern expressions are left out.
  • list_org_custom_patterns: List an organization's custom secret scanning patterns with name, state, push protection flag and version; the pattern expressions are left out.
  • list_org_pattern_configurations: Get an organization's secret scanning pattern configuration: per-provider alert totals, false positive and bypass rates and the push protection setting.

BYOK key

You bring your own GitHub Secret Scanning GitHub personal access token (security_events scope, or repo scope) (https://github.com/settings/tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.github.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the GitHub Secret Scanning API (api.github.com) with a BYOK key; documentation: https://docs.github.com/en/rest/secret-scanning/secret-scanning. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Secret Scanning. GitHub Secret Scanning and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your GitHub Secret Scanning account.

Built for: Worldwide. Languages: English.