repoward
sanoy24/repoward
GitHub MCP server that blocks private-to-public leaks by agents, with approvals and audit.
- GitHub stars
- 1
- tools
- 12
- auth
- Secret needed
- transport
- STDIO
- env var
- 1
- last updated
- Nov 9, 2026
Tools
12 toolsPublic tool metadata for what this MCP can expose to an agent.
github_list_issuesRead tool listing GitHub issues.
Read tool listing GitHub issues.
No parameter schema in public metadata yet.
github_get_issueRead tool fetching a single GitHub issue.
Read tool fetching a single GitHub issue.
No parameter schema in public metadata yet.
github_search_codeRead tool searching code in repositories.
Read tool searching code in repositories.
No parameter schema in public metadata yet.
github_get_fileRead tool fetching a file from a repository.
Read tool fetching a file from a repository.
No parameter schema in public metadata yet.
ci_get_statusRead tool returning CI status.
Read tool returning CI status.
No parameter schema in public metadata yet.
ci_get_job_logsRead tool returning CI job logs.
Read tool returning CI job logs.
No parameter schema in public metadata yet.
github_create_branchWrite tool creating a branch, limited to the configured prefix (agent/ by default).
Write tool creating a branch, limited to the configured prefix (agent/ by default).
No parameter schema in public metadata yet.
github_commit_filesWrite tool committing files to a branch.
Write tool committing files to a branch.
No parameter schema in public metadata yet.
github_create_pull_requestWrite tool creating a pull request, draft only by default.
Write tool creating a pull request, draft only by default.
No parameter schema in public metadata yet.
github_commentWrite tool posting a comment.
Write tool posting a comment.
No parameter schema in public metadata yet.
github_merge_pull_requestDangerous tool for merging a pull request; requires human approval and is off until a policy enables it.
Dangerous tool for merging a pull request; requires human approval and is off until a policy enables it.
No parameter schema in public metadata yet.
github_delete_branchDangerous tool for deleting a branch; requires human approval.
Dangerous tool for deleting a branch; requires human approval.
No parameter schema in public metadata yet.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageConfiguration
GITHUB_TOKEN*secretFine-grained personal access token limited to the repositories in your policy.
Readme
repoward
A GitHub MCP server that stops AI agents acting on what an attacker's issue told them to do.
Status: alpha. It has not had an independent security review. Read the threat model, especially the part about where it runs.
The problem
An agent with GitHub access can read a malicious public issue, read a private repository, and post the contents in a public pull request. Each call looks allowed on its own, so per-tool permissions do not stop the sequence. This is the attack Invariant Labs published against agents using GitHub's MCP server, and repoward's test suite replays it against real repositories.
Flow guard
Before every write, repoward checks what this agent has already read, using facts from GitHub:
| If the agent has read | Then |
|---|---|
| Anything from a private repository | Writes to public repositories are denied |
An issue, pull request or comment from an author outside OWNER, MEMBER and COLLABORATOR, or a job log | Each write needs human approval |
Details
- Repository
- github.com/sanoy24/repoward
- Category
- Developer Tools
- Package
repoward- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
