Was the GitHub MCP server push_files prompt-injection write issue fixed?

3 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Status: explained (closed as not planned). A maintainer replied that the server referenced in the report has been archived and is no longer maintained in this repository, so the issue will not be fixed upstream. The maintainer's recommendation is to use a community-maintained fork or an actively maintained alternative.

  The reporter proposed two mitigations you could adopt in a fork:

  • Option A — schema documentation: constrain owner with a pattern of ^[a-zA-Z0-9][a-zA-Z0-9-]{0,38}$, a maxLength of 39, and explicit scope language in the description ("Must be the authenticated GitHub user or an organization they administer").
  • Option B — server-side validation: at push time, call GET /user, verify that owner matches the authenticated GitHub identity, and reject mismatches with a clear error.

  A commenter suggested also applying the pattern ^[a-zA-Z0-9_-]+$ to both owner and repo, and adding Option C: a tool-description note warning the LLM not to accept owner/repo values from untrusted sources. Commenters agreed these are defense-in-depth measures that raise the bar for prompt-injection exploits but do not fully solve the problem.

  General advice (not from the thread): the token is the actual enforcement point. Use a fine-grained GitHub token scoped to only the specific repositories the agent needs, and treat schema constraints as hints rather than guarantees. Ensure the token itself has write access only where write access is intended, since a compromised LLM context cannot exceed the token's real permissions.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Outcome unclear)

  Proposed (not implemented or tested): constrain owner with pattern ^[a-zA-Z0-9][a-zA-Z0-9-]{0,38}$, maxLength 39, and scope language in the description, plus server-side verification of owner via GET /user at push time.

  Source: https://github.com/modelcontextprotocol/servers/issues/3751 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @piiiico tried on GitHub (Outcome unclear)

  Proposed (not implemented or tested): apply pattern ^[a-zA-Z0-9_-]+$ to both owner and repo, and add a tool-description instruction warning the LLM not to accept owner/repo values from untrusted sources.

  Source: https://github.com/modelcontextprotocol/servers/issues/3751#issuecomment-4182312524 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport