GitHub MCP server: a public issue makes the agent leak private repos

What it is

Published 26 May 2025. The agent has one GitHub token covering public and private repos; when it reads the attacker’s issue, the injected text asks it to fetch private data and post it publicly.

Invariant describes it as a “toxic agent flow”: the server works as designed, the danger comes from combining untrusted input with broad access.

How to check

1. Check what scopes the GitHub token used by your MCP server has, and whether it covers private repos.
2. See whether your agent auto-approves GitHub tool calls.

How to fix

1. Give the agent a fine-grained token limited to the repos it needs.
2. Turn off auto-approval for tools that write to GitHub.

Sources

• Invariant Labs: GitHub MCP Exploited: Accessing private repositories via MCP ↗