[mcp-tools-report] GitHub MCP Remote Server Tools Report — 2026-08-02

[github-actions[bot]]

GitHub MCP Remote Server Tools Report

Generated: 2026-08-02
MCP Mode: Remote
Toolsets: All
Previous Report: None (no /tmp/gh-aw/cache-memory/github-mcp-tools.json from a prior run was found — this is the first run with cache-memory enabled)

Executive Summary

• Total Tools Discovered (this session): 58
• Toolset Categories Observed: 20 (of 22 known toolsets in the JSON mapping)
• Report Date: 2026-08-02
• Source: pkg/workflow/data/github_toolsets_permissions.json
• Instructions File: .github/aw/github-mcp-server.md
• Changes Since Last Report: N/A — first run

Important scope caveat: This workflow's GitHub MCP tool is configured with toolsets: [all], but the workflow's token only carries read permissions (contents, actions, discussions, issues, pull-requests, security-events — all : read, per this workflow's frontmatter). Every one of the 58 tools actually callable in this session is a get_*/list_*/search_* read method; no write tool (create_*, update_*, delete_*, merge_*, *_write, star_repository, etc.) is exposed. Absence of a tool from this session is not evidence it was removed from the server — it may simply be filtered by token scope. Discrepancy analysis below is restricted to tools this session could plausibly discover (read-side), to avoid false "removed" findings.

Inconsistency Detection

Toolset Integrity Checks

• Duplicate Tools: get_label is intentionally dual-registered in both issues and labels (documented, not a bug).
• Miscategorized Tools: None found among observable tools — check_dependency_vulnerabilities (advisory-DB lookup) fits security_advisories better than dependabot despite the name similarity; run_secret_scanning (ad-hoc content scan) fits secret_protection rather than code_security. Both are now correctly placed.
• Naming Inconsistencies: actions_get/actions_list and projects_get/projects_list/projects_write use a <toolset>_<verb> scheme that diverges from the more common get_<noun>/list_<noun> pattern used elsewhere (e.g. get_commit, list_branches). Not a defect, just a naming convention the newer consolidated tools (actions, projects, issue_read, issue_write, pull_request_read) use — likely an intentional move toward fewer, parameterized tools.
• Orphaned Tools: semantic_issue_similarity_search and semantic_issues_search were entirely unmapped in the JSON prior to this run (see below) — now placed under issues.
• Missing Expected Tools: context toolset tools (get_me, get_team_members, get_teams) and the entire copilot toolset are not observable this session — expected given the read-only token, not a genuine gap (see scope caveat above).

JSON Mapping Comparison

Discrepancies Between MCP Server and JSON Mapping

Summary:

• Total Discrepancies: 4 (all "extra tools" — none removed, none moved)
• Missing Tools (in JSON but not in MCP): 0 (not evaluated for write-tools/context/copilot — see scope caveat)
• Extra Tools (in MCP but not in JSON): 4 — now fixed
• Moved Tools (different toolset): 0

Extra Tools (in MCP but not in JSON) — fixed in this run

Toolset	Tool Name	Action Taken
security_advisories	check_dependency_vulnerabilities	Added to JSON mapping (v2.3 → v2.4)
secret_protection	run_secret_scanning	Added to JSON mapping
issues	semantic_issue_similarity_search	Added to JSON mapping
issues	semantic_issues_search	Added to JSON mapping

The prior JSON's changelog note claimed these 4 tools were "removed upstream," but all 4 are live and callable in this session — the note no longer reflects reality (either they were re-added upstream, or the prior removal was made in error). Notably, the existing .github/aw/github-mcp-server.md doc had already re-documented 3 of the 4 (under a now-stale standalone search toolset section it never reconciled with the JSON's repos/orgs/users redistribution) — the two source-of-truth files disagreed with each other. This run reconciled both onto one consistent scheme.

Action: Created pull request with the updated JSON mapping and synced documentation (see below — PR created via create_pull_request safe-output in this run; refer to the workflow run's output for the PR link, since it is not resolvable to a URL from within this sandboxed session).

Documentation Sync (.github/aw/github-mcp-server.md)

Beyond the JSON fix, the doc had its own independent staleness, now corrected in the same PR:

• Removed the standalone search toolset section (already absent from the JSON since v2.x redistributed it) and folded its tools into repos (search_code, search_commits, search_repositories — including the repo: qualifier caveat), orgs (search_orgs), users (search_users), and issues (both semantic search tools).
• Added two toolsets present in the JSON but never documented: code_quality (get_code_quality_finding) and copilot (assign_copilot_to_issue, create_pull_request_with_copilot, request_copilot_review).
• Updated the "Enable explicitly when needed" table and bumped Last Updated to 2026-08-02.

Tools by Toolset

actions — GitHub Actions workflows ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/actions.go")pkg/github/actions.go(/a))

Tool Name	Purpose	Key Parameters
actions_get	Get details about a specific workflow, workflow run, job, or artifact	method, owner, repo, resource_id
actions_list	List workflows, workflow runs, jobs, or artifacts	method, owner, repo, workflow_runs_filter, workflow_jobs_filter
get_job_logs	Get logs for GitHub Actions workflow jobs (single job or all failed jobs in a run)	owner, repo, job_id or run_id+failed_only, return_content

code_quality — Code quality findings ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/code_scanning.go")pkg/github/code_scanning.go(/a))

Tool Name	Purpose	Key Parameters
get_code_quality_finding	Get details of a specific code quality finding	owner, repo, findingNumber

code_security — Code scanning alerts ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/code_scanning.go")pkg/github/code_scanning.go(/a))

Tool Name	Purpose	Key Parameters
get_code_scanning_alert	Get details of a specific code scanning alert	owner, repo, alertNumber
list_code_scanning_alerts	List code scanning alerts for a repository	owner, repo, state, severity, ref (always bound with state: open, severity: critical,high)

copilot_spaces — GitHub Copilot Spaces, remote-only ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/copilot_spaces.go")pkg/github/copilot_spaces.go(/a))

Tool Name	Purpose	Key Parameters
get_copilot_space	Provide additional context from a specific Copilot Space	owner, name
list_copilot_spaces	Retrieve the list of Copilot Spaces accessible to the user	—

dependabot — Dependabot alerts ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/dependabot.go")pkg/github/dependabot.go(/a))

Tool Name	Purpose	Key Parameters
get_dependabot_alert	Get details of a specific Dependabot alert	owner, repo, alertNumber
list_dependabot_alerts	List Dependabot alerts for a repository	owner, repo, state, severity

discussions — GitHub Discussions ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/discussions.go")pkg/github/discussions.go(/a))

Tool Name	Purpose	Key Parameters
get_discussion	Get a specific discussion by ID	owner, repo, discussionNumber
get_discussion_comments	Get comments from a discussion	owner, repo, discussionNumber, includeReplies
list_discussion_categories	List discussion categories with id/name	owner, repo
list_discussions	List discussions for a repository or org	owner, repo, category, orderBy, direction

gists — Gist operations ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/gists.go")pkg/github/gists.go(/a))

Tool Name	Purpose	Key Parameters
get_gist	Get gist content of a particular gist by ID	gist_id
list_gists	List gists for a user	username, since

git — Git API operations, tree/refs ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/repositories.go")pkg/github/repositories.go(/a))

Tool Name	Purpose	Key Parameters
get_repository_tree	Get the tree structure (files/dirs) at a ref or SHA	owner, repo, tree_sha, recursive, path_filter

github_support_docs_search — GitHub support documentation search, remote-only ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/dynamic_tools.go")pkg/github/dynamic_tools.go(/a))

Tool Name	Purpose	Key Parameters
github_support_docs_search	Retrieve docs for GitHub product/support questions	query

issues — Issue management ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/issues.go")pkg/github/issues.go(/a))

Tool Name	Purpose	Key Parameters
issue_read	Get issue details, comments, sub-issues, parent, or labels	method, owner, repo, issue_number
list_issue_fields	List custom issue fields for a repo/org	owner, repo
list_issue_types	List supported issue types	owner, repo
list_issues	List issues in a repository	owner, repo, state, labels, field_filters
search_issues	Search issues (scoped to is:issue)	query, sort, order
semantic_issue_similarity_search (re-added this run)	Find issues semantically similar to a given issue	owner, repo, issue_number, threshold
semantic_issues_search (re-added this run)	Natural-language issue search via embeddings	query, owner, repo

labels — Label management ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/labels.go")pkg/github/labels.go(/a))

Tool Name	Purpose	Key Parameters
get_label	Get a specific label from a repository (dual-registered with issues)	owner, repo, name
list_label	List labels from a repository	owner, repo

notifications — Notification management ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/notifications.go")pkg/github/notifications.go(/a))

Tool Name	Purpose	Key Parameters
get_notification_details	Get detailed info for a specific notification	notificationID
list_notifications	List notifications for the authenticated user	filter, owner, repo, since, before

orgs — Organization operations ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/search.go")pkg/github/search.go(/a))

Tool Name	Purpose	Key Parameters
list_org_repository_security_advisories	List repository security advisories for an org (dual with security_advisories)	org, state, sort
search_orgs	Find organizations by name, location, or metadata	query, sort

projects — GitHub Projects, requires PAT ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/projects.go")pkg/github/projects.go(/a))

Tool Name	Purpose	Key Parameters
projects_get	Get a project, project field, item, or status update	method, owner, project_number
projects_list	List projects, fields, items, or status updates	method, owner, project_number, query

pull_requests — Pull request operations ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/pullrequests.go")pkg/github/pullrequests.go(/a))

Tool Name	Purpose	Key Parameters
list_pull_requests	List pull requests in a repository	owner, repo, state, base, sort
pull_request_read	Get PR details, diff, status, files, commits, reviews, comments, or check runs	method, owner, repo, pullNumber
search_pull_requests	Search PRs (scoped to is:pr)	query, sort, order

repos — Repository operations, incl. repo/code/commit search ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/repositories.go")pkg/github/repositories.go(/a) / (a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/search.go")search.go(/a))

Tool Name	Purpose	Key Parameters
get_commit	Get details for a commit	owner, repo, sha
get_file_contents	Get contents of a file or directory	owner, repo, path, ref
get_latest_release	Get the latest release	owner, repo
get_release_by_tag	Get a release by tag name	owner, repo, tag
get_tag	Get details about a specific git tag	owner, repo, tag
list_branches	List branches in a repository	owner, repo
list_commits	List commits of a branch	owner, repo, sha, author, since, until
list_releases	List releases in a repository	owner, repo
list_repository_collaborators	List collaborators of a repository	owner, repo, affiliation
list_tags	List git tags in a repository	owner, repo
search_code	Search code across all GitHub repositories	query, sort, order
search_commits	Search commits via GitHub's commit search syntax	query, sort, order
search_repositories	Find repositories by name/description/topics/metadata (⚠️ repo: qualifier is ignored — see doc)	query, sort, order

secret_protection — Secret scanning ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/secret_scanning.go")pkg/github/secret_scanning.go(/a))

Tool Name	Purpose	Key Parameters
get_secret_scanning_alert	Get details of a specific secret scanning alert	owner, repo, alertNumber
list_secret_scanning_alerts	List secret scanning alerts for a repository	owner, repo, state, resolution
run_secret_scanning (re-added this run)	Scan supplied file contents/diffs for exposed secrets	files, owner, repo

security_advisories — Security advisories ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/security_advisories.go")pkg/github/security_advisories.go(/a))

Tool Name	Purpose	Key Parameters
check_dependency_vulnerabilities (re-added this run)	Check a list of dependencies against the GitHub Advisory Database	owner, repo, dependencies
get_global_security_advisory	Get a global security advisory	ghsaId
list_global_security_advisories	List global security advisories, with filters	type, severity, ecosystem, cveId, ghsaId
list_org_repository_security_advisories	List security advisories for all repos in an org	org, state
list_repository_security_advisories	List security advisories for a specific repository	owner, repo, state

stargazers — Repository stars ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/repositories.go")pkg/github/repositories.go(/a))

Tool Name	Purpose	Key Parameters
list_starred_repositories	List repositories starred by a user	username, sort, direction

users — User information, user search ((a href="https://github.com/github/github-mcp-server/blob/main/pkg/github/search.go")pkg/github/search.go(/a))

Tool Name	Purpose	Key Parameters
search_users	Find GitHub users by username, real name, or profile info	query, sort

Not observable this session (present in the JSON mapping; excluded from this session's tool list because the workflow token is read-only — see scope caveat): context (get_me, get_team_members, get_teams), copilot (assign_copilot_to_issue, create_pull_request_with_copilot, request_copilot_review), and every write-side tool in repos, issues, pull_requests, discussions, gists, labels, notifications, projects, stargazers, and actions (actions_run_trigger).

All known toolsets (per the JSON mapping): actions, code_quality, code_security, context, copilot, copilot_spaces, dependabot, discussions, gists, git, github_support_docs_search, issues, labels, notifications, orgs, projects, pull_requests, repos, secret_protection, security_advisories, stargazers, users

Recommended Default Toolsets

Recommended Defaults: context, repos, issues, pull_requests — unchanged from the current default in .github/aw/github-mcp-server.md.

Rationale:

• These four cover the operations nearly every workflow persona needs: reading repo content/history, tracking and commenting on issues, and reviewing/creating PRs.
• context stays in defaults for its team-awareness tools (get_teams, get_team_members), not for workflow identity — that's injected separately via <github-context> regardless of toolset selection.
• No evidence from this run's tool discovery suggests changing the defaults: the tools re-added this run (check_dependency_vulnerabilities, run_secret_scanning, semantic issue search) are all specialized/security-adjacent and appropriately excluded from defaults.

Specialized Toolsets (enable explicitly when needed): actions, code_quality, code_security, copilot, copilot_spaces (remote-only), dependabot, discussions, gists, git, github_support_docs_search (remote-only), labels, notifications, orgs, projects (requires PAT), secret_protection, security_advisories, stargazers, users.

Toolset Configuration Reference

tools:
  github:
    mode: "remote"  # or "local"
    toolsets: [all]  # or specific toolsets like [repos, issues, pull_requests]

Available toolset options: context, repos, issues, pull_requests, actions, code_quality, code_security, copilot, copilot_spaces, dependabot, discussions, gists, git, github_support_docs_search, labels, notifications, orgs, projects, secret_protection, security_advisories, stargazers, users, all

Note: experiments and search no longer exist as standalone toolsets in the current JSON mapping — experiments' dynamic-toolset tools (enable_toolset, get_toolset_tools, list_available_toolsets) and the old search toolset's tools have both been redistributed/removed upstream. This workflow's own mission brief (and the github-mcp-tools-report-guidelines skill / workflow success criteria) still lists both as toolsets to check — worth updating on a future pass to avoid repeatedly "discovering" toolsets that no longer exist.

Notes and Observations

• Two disagreeing sources of truth, now reconciled: pkg/workflow/data/github_toolsets_permissions.json and .github/aw/github-mcp-server.md had drifted apart independently — the JSON dropped 4 tools it thought were removed upstream, while the doc kept a stale standalone search toolset the JSON had already abandoned. This run's PR brings both back into agreement.
• Read-only session limits self-inspection: Because this workflow's token only grants read scopes, roughly half of the tools documented in the JSON/doc (all write methods, context, copilot) could not be independently re-confirmed this run. Treat this report's "58 tools discovered" as a lower bound on the live server's surface, not the full inventory.
• search_repositories repo: quirk: confirmed still relevant — documented in both the repos section of the doc and the pagination doc.
• The custom tool-list-diff and tool-doc-writer sub-agents referenced by this workflow's prompt are not available as invokable agent types in this session's runtime (only claude, Explore, general-purpose, Plan, statusline-setup are registered) — this report's discovery, diffing, and documentation work was done directly instead.

Methodology

• Discovery Method: Self-inspection of available tools in the GitHub MCP remote server (function list available to this session), cross-checked against pkg/workflow/data/github_toolsets_permissions.json and .github/aw/github-mcp-server.md, plus a search_code lookup against github/github-mcp-server and related repos to corroborate tool placement for the 4 re-added tools.
• MCP Configuration: Remote mode, toolsets: [all], but a read-only GITHUB_TOKEN-derived credential (see scope caveat).
• Categorization: Based on GitHub API domains, tool naming, and the existing JSON/doc's prior categorization.
• Documentation: Derived from tool names, descriptions, and parameter schemas visible to this session.
• JSON Mapping: pkg/workflow/data/github_toolsets_permissions.json
• Instructions: .github/aw/github-mcp-server.md
• MCP Server Source: github/github-mcp-server

Generated by 📊 GitHub MCP Remote Server Tools Report Generator · agent · 242.1 AIC · ⌖ 19 AIC · ⊞ 11K · ◷

• expires on Aug 5, 2026, 4:57 AM UTC-08:00