Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

GitHub Supply Chain (BYOK) — connector documentation

  • MCP endpoint: https://byok-github-supply-chain.connectorbay.com/mcp
  • REST API: POST https://byok-github-supply-chain.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-github-supply-chain.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own GitHub Supply Chain personal access token, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-github-supply-chain.connectorbay.com/health · Tool schemas: https://byok-github-supply-chain.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-github-supply-chain · agent@connectorbay.com

What GitHub Supply Chain (BYOK) is for

GitHub Supply Chain (BYOK) lets an AI assistant read your own GitHub Supply Chain data through the GitHub Supply Chain API with a key you supply (personal access token). Read-only: 7 tools (list_attestation_repositories, list_org_attestations, list_repo_attestations, list_artifact_storage_records, list_artifact_deployment_records, get_immutable_releases_settings, list_immutable_releases_repositories). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.github.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Supply Chain. GitHub Supply Chain and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which octo-org repositories publish artifact attestations?"
  • "Which attestations exist for this image digest in octo-org?"
  • "Which attestations does octocat/Hello-World have for this digest?"
  • "Where is this container image digest stored for octo-org?"
  • "Where is this image digest deployed for octo-org and does it carry runtime risks?"
  • "Does octo-org enforce immutable releases?"

What it does

  • list_attestation_repositories: List the repositories of an organization that have artifact attestations, optionally for one predicate type.
  • list_org_attestations: List an organization's attestations for one artifact digest (bundle contents are not returned; only the repository, bundle URL and initiator).
  • list_repo_attestations: List a repository's attestations for one artifact digest (bundle contents are not returned).
  • list_artifact_storage_records: List where an artifact digest is stored (registry, repository, status) according to the organization's artifact metadata.
  • list_artifact_deployment_records: List where an artifact digest is deployed (environment, cluster, deployment name, runtime risks) according to the organization's artifact metadata.
  • get_immutable_releases_settings: Get whether an organization enforces immutable releases and for which repositories.
  • list_immutable_releases_repositories: List the repositories selected for immutable releases enforcement in an organization.

BYOK key

You bring your own GitHub Supply Chain personal access token (https://github.com/settings/tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.github.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the GitHub Supply Chain API (api.github.com) with a BYOK key; documentation: https://docs.github.com/en/rest/orgs/artifact-metadata. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Supply Chain. GitHub Supply Chain and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your GitHub Supply Chain account.

Built for: Worldwide. Languages: English.