Go modules · proxy.golang.org

github.com/github/github-mcp-server

Remote Payload: matched "api.github.com/graphql"

Why PkgRadar flagged v1.3.0

Severity	Signal	Evidence
medium	Remote Payload	matched "api.github.com/graphql" · github.com/github/[email protected]/pkg/utils/api.go

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v1.3.0`	Review	12	2026-06-12
`v1.2.1-0.20260610220934-918a42f05a34`	Review	12	2026-06-12
`v1.2.1-0.20260610175504-8bbd902b9e45`	Review	12	2026-06-11
`v1.2.0`	Review	12	2026-06-09
`v1.1.3-0.20260605140422-457f59932ac0`	Review	12	2026-06-06
`v1.1.3-0.20260604091723-33849e98eb47`	Review	12	2026-06-06
`v1.1.3-0.20260531101506-2bd162acaf4c`	Review	12	2026-06-01
`v1.1.1`	Review	12	2026-05-30
`v1.1.1-0.20260528174210-7d46f8d8db1d`	Review	12	2026-05-30
`v1.1.0`	Review	24	2026-05-29
`v1.0.6-0.20260527142636-e091ea63d721`	Review	24	2026-05-29

Block this in CI

PkgRadar gates github.com/github/github-mcp-server (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/github/[email protected]