Be the first to get access to new connectors. Get early access →
ConnectorBay Early access
Discover
GitHub Supply Chain (BYOK) icon

GitHub Supply Chain (BYOK)

Read GitHub artifact attestations, artifact storage and deployment records and immutable release settings of an organization with your own token

Unify Dynamics LLC

Tools7read-only
Sign-inBYOKbring your own key
Key keptNeverused for one call only
PriceFreeoptional Pro limits
ProviderGitHub Supply Chainunofficial, not affiliated
Works withMCP · RESTany agent

Try asking

Real questions, and the tools your agent calls to answer them.

Which octo-org repositories publish artifact attestations?
Tools called
list_attestation_repositories
Which attestations exist for this image digest in octo-org?
Tools called
list_org_attestations
Which attestations does octocat/Hello-World have for this digest?
Tools called
list_repo_attestations
Where is this container image digest stored for octo-org?
Tools called
list_artifact_storage_records
Where is this image digest deployed for octo-org and does it carry runtime risks?
Tools called
list_artifact_deployment_records
Does octo-org enforce immutable releases?
Tools called
get_immutable_releases_settings

About

GitHub Supply Chain (BYOK) lets an AI assistant read your own GitHub Supply Chain data through the GitHub Supply Chain API with a key you supply (personal access token). Read-only: 7 tools (list_attestation_repositories, list_org_attestations, list_repo_attestations, list_artifact_storage_records, list_artifact_deployment_records, get_immutable_releases_settings, list_immutable_releases_repositories). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.github.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Supply Chain. GitHub Supply Chain and its logos are trademarks of their owners and are used only to say which service the connector works with.

Sources: Live from the GitHub Supply Chain API (api.github.com) with a BYOK key; documentation: https://docs.github.com/en/rest/orgs/artifact-metadata. Endpoints checked against that documentation on 2026-10-16.

Privacy

The publisher, Unify Dynamics LLC, states that tool inputs are processed in memory and not retained.

Data not collectedNo account, no profile, no stored prompts or results.

What it can do

7 tools, grouped by job. Every one is read-only or compute-only.

OpenAPI
Read your data7 tools
  • List attestation repositoriesList the repositories of an organization that have artifact attestations, optionally for one predicate type.
  • List org attestationsList an organization's attestations for one artifact digest (bundle contents are not returned; only the repository, bundle URL and initiator).
  • List repo attestationsList a repository's attestations for one artifact digest (bundle contents are not returned).
  • List artifact storage recordsList where an artifact digest is stored (registry, repository, status) according to the organization's artifact metadata.
  • List artifact deployment recordsList where an artifact digest is deployed (environment, cluster, deployment name, runtime risks) according to the organization's artifact metadata.
  • Get immutable releases settingsGet whether an organization enforces immutable releases and for which repositories.
  • List immutable releases repositoriesList the repositories selected for immutable releases enforcement in an organization.

Information

PublisherUnify Dynamics LLC
CategoryDeveloper tools
LanguagesEnglish
Built forWorldwide
CompatibilityAny MCP client · any agent · REST
Version0.1.0
MCP endpointhttps://byok-github-supply-chain.connectorbay.com/mcp
REST APIopenapi.json
SupportGet help · Status
CountryWorldwide
FunctionOther
LayerDeep connectors

More like this

More in Other

Vero (BYOK)

Read your Vero email, SMS and push broadcasts, journeys with their message steps, subject lines and locales, and preference center topics with your own Campaigns API key

Live · MCP + REST11 tools

Vectara (BYOK)

Read your Vectara corpora, documents, jobs, agents, pipelines, models and query history with your own API key

Live · MCP + REST10 tools

Vantage (BYOK)

Read your Vantage cloud cost reports, costs, budgets, anomaly alerts, savings recommendations and connected integrations with your own API token

Live · MCP + REST10 tools

Unkey (BYOK)

Read your Unkey API key management and deployment data (projects, apps, deployments, domains, keys, identities, roles) with your own root key

Live · MCP + REST10 tools

Twelve Labs (BYOK)

Read your Twelve Labs video understanding indexes, indexed videos, assets and entity collections with your own API key

Live · MCP + REST8 tools

SurveyHero (BYOK)

Read your SurveyHero surveys, questions, collectors, languages, response overviews and tabulated report results with your own API key

Live · MCP + REST8 tools

Get GitHub Supply Chain (BYOK)

Free · BYOK · Read-only

BYOK: bring your own keyThis connector uses your own GitHub Supply Chain personal access token. Create one at https://github.com/settings/tokens, with the fewest permissions it needs (read-only if the provider offers it). Your assistant sends it in the X-Upstream-Key header with every request. It is used for that one call only: never stored, logged or cached, and only ever sent to GitHub Supply Chain. Revoke it at the provider whenever you like. Unofficial connector: not affiliated with GitHub Supply Chain.