Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

GitHub Security (BYOK) — connector documentation

  • MCP endpoint: https://byok-githubsecurity.connectorbay.com/mcp
  • REST API: POST https://byok-githubsecurity.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-githubsecurity.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own GitHub Security personal access token (fine-grained or classic), sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-githubsecurity.connectorbay.com/health · Tool schemas: https://byok-githubsecurity.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-githubsecurity · agent@connectorbay.com

What GitHub Security (BYOK) is for

GitHub Security (BYOK) lets an AI assistant read your own GitHub Security data through the GitHub Security API with a key you supply (personal access token (fine-grained or classic)). Read-only: 10 tools (list_global_advisories, get_global_advisory, list_repo_security_advisories, list_org_security_advisories, list_repo_dependabot_alerts, get_dependabot_alert, list_org_dependabot_alerts, list_code_scanning_alerts, get_code_scanning_alert, list_secret_scanning_alerts). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.github.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Security. GitHub Security and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which critical npm advisories were published this month?"
  • "What does advisory GHSA-abcd-1234-wxyz affect and which version fixes it?"
  • "What security advisories are open on octocat/Hello-World?"
  • "Which repository security advisories are in triage in octo-org?"
  • "Which open Dependabot alerts does octocat/Hello-World have?"
  • "Show Dependabot alert 7 on octocat/Hello-World"

What it does

  • list_global_advisories: Search GitHub's global advisory database (reviewed by default) by ecosystem, severity, CVE id, CWE or affected package, with CVSS and EPSS scores. Works with a token that has no special scopes.
  • get_global_advisory: Get one global advisory with description, affected packages and patched versions, CVSS and EPSS scores, CWEs and references.
  • list_repo_security_advisories: List a repository's own security advisories (private vulnerability reports) filtered by state. Needs access to the repository's security advisories.
  • list_org_security_advisories: List repository security advisories across an organization filtered by state.
  • list_repo_dependabot_alerts: List a repository's Dependabot alerts with package, manifest, advisory, severity, CVSS and EPSS scores and first patched version. Open alerts by default.
  • get_dependabot_alert: Get one Dependabot alert by number with the advisory summary, severity and patched version.
  • list_org_dependabot_alerts: List Dependabot alerts across all repositories of an organization with package, advisory, severity and repository.
  • list_code_scanning_alerts: List a repository's code scanning alerts with rule, severity, tool, state, file location and dates. Open alerts unless a state is given.
  • get_code_scanning_alert: Get one code scanning alert by number with rule description, tool, branch and file location.
  • list_secret_scanning_alerts: List a repository's secret scanning alerts with secret type, provider, validity, state and push protection bypass. The secret values themselves are hidden and not returned.

BYOK key

You bring your own GitHub Security personal access token (fine-grained or classic) (https://github.com/settings/tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.github.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the GitHub Security API (api.github.com) with a BYOK key; documentation: https://docs.github.com/en/rest/security-advisories. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by GitHub Security. GitHub Security and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your GitHub Security account.

Built for: Worldwide. Languages: English.