{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "github-mcp-server",
    "testedOn": "2026-10-18",
    "coverage": "remote-boundary",
    "summary": "Hosted initialization stopped at authentication. The read-only route also required a token; its discovery metadata still advertised broad OAuth scopes.",
    "identity": {
      "version": "Remote deployment version not disclosed by the observed responses",
      "target": "[GitHub remote MCP origin]/mcp/; origin omitted from this public record",
      "integrity": "HTTPS certificate verification enabled. Public resource-metadata body SHA-256: cbabd24fd62d5d52687cd6e47d66a17a1d817a029834b757ee65e9d3cf1c7aef. This fingerprints the observed metadata, not the deployed server implementation."
    },
    "environment": [
      "Windows 11 build 26200; Python 3.12.10 urllib; OpenSSL 3.0.16.",
      "No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.",
      "Observed 2026-10-19T00:47:10.611130+00:00 through 2026-10-19T00:47:52.509957+00:00 UTC.",
      "One request per listed check; 20-second timeout and 64-KiB response cap. Initial sandbox DNS failures were retained separately and resolved with approved network access; they are not endpoint failures."
    ],
    "checks": [
      {
        "id": "github-mcp-server-initialize",
        "name": "Credential-free initialization",
        "method": "POST [GitHub remote MCP origin]/mcp/; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.",
        "observed": "HTTP 401 at 2026-10-19T00:47:10.611130+00:00. WWW-Authenticate: Bearer; resource_metadata=[GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/. Response text reports the required Authorization header is missing.",
        "outcome": "pass"
      },
      {
        "id": "github-mcp-server-resource-metadata",
        "name": "Public authentication discovery",
        "method": "GET [GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.",
        "expected": "Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.",
        "observed": "HTTP 200 at 2026-10-19T00:47:20.626366+00:00; Content-Type: application/json. Resource: [GitHub remote MCP origin]/mcp/. 10 supported scopes: repo, read:org, read:user, user:email, read:packages, write:packages, read:project, project, gist, notifications. Authorization server: https://github.com/login/oauth. Bearer methods: header.",
        "outcome": "pass"
      },
      {
        "id": "github-mcp-server-readonly-initialize",
        "name": "Read-only variant: Credential-free initialization",
        "method": "POST [GitHub remote MCP origin]/mcp/readonly; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.",
        "observed": "HTTP 401 at 2026-10-19T00:47:24.665306+00:00. WWW-Authenticate: Bearer; resource_metadata=[GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/readonly. Response text reports the required Authorization header is missing.",
        "outcome": "pass"
      },
      {
        "id": "github-mcp-server-readonly-resource-metadata",
        "name": "Read-only variant: Public authentication discovery",
        "method": "GET [GitHub remote MCP origin]/.well-known/oauth-protected-resource/mcp/readonly; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.",
        "expected": "Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.",
        "observed": "HTTP 200 at 2026-10-19T00:47:52.509957+00:00; Content-Type: application/json. Resource: [GitHub remote MCP origin]/mcp/readonly. 10 supported scopes: repo, read:org, read:user, user:email, read:packages, write:packages, read:project, project, gist, notifications. Authorization server: https://github.com/login/oauth. Bearer methods: header.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "A read-only URL does not describe token scope",
        "basis": "observed",
        "severity": "informational",
        "detail": "Both default and /readonly initialization returned 401. Both metadata documents advertised the same 10 scopes, including repo and write:packages. This is public discovery metadata, not a granted token or proof that write tools are available on /readonly.",
        "practicalAdvice": "Configure the read-only tool surface and restrict the credential separately. After signing in, verify the actual tools and selected repositories."
      },
      {
        "title": "Content filtering has a separate job",
        "basis": "documented",
        "severity": "informational",
        "detail": "GitHub describes lockdown filtering as best effort. It is not a security boundary, and remote toolsets differ from the local build.",
        "practicalAdvice": "Keep repository text as evidence. Review proposed actions and avoid broad credentials even when the task only reads."
      }
    ],
    "caveats": [
      "[GitHub remote MCP origin] is an explicit placeholder for the tested official host. Recover the exact current endpoint from the linked official GitHub remote-server guide; exact requests are retained in the private evaluation evidence.",
      "Use a narrowly selected toolset plus read-only mode for research. A token that can read private repositories can still disclose their contents to the AI host.",
      "Hosted service deployment identity was not disclosed by the observed responses; a local repository release does not identify this remote build."
    ],
    "notTested": [
      "OAuth consent, token restrictions, repository or organization permissions, revocation and tenant isolation.",
      "Actual tool lists, repository reads, write denial on /readonly, lockdown filtering and prompt-injection resistance.",
      "The local binary/container and authenticated release-review example.",
      "These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security."
    ],
    "sources": [
      {
        "label": "Official remote endpoint, read-only routing and lockdown limits",
        "url": "https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md"
      },
      {
        "label": "Official server configuration",
        "url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md"
      }
    ],
    "reportUrl": "/interface-evaluations/github-mcp-server.json"
  }
}