A stateful authentication GitHub MCP server providing tools for GitHub API interactions including repositories, issues, pull requests, users, organizations, and more
Server provides 6 tools with basic schemas and descriptions. Tool naming follows verb_noun convention (get_*, list_*, enable_*). However, descriptions are inconsistent in depth, some lack context on when to use them. Parameter descriptions exist but are minimal (avg ~40 chars). Output schemas are not documented in the source code provided. Error handling and recovery guidance are absent. The dynamic toolset pattern (enable_toolset, list_available_toolsets, get_toolset_tools) is novel but adds complexity without clear LLM guidance on when to invoke these discovery tools vs. direct tools.
Enable one of the sets of tools the GitHub MCP server provides, use get_toolset_tools and list_available_toolsets first to see what this will enable
Get details of the authenticated GitHub user. Use this when a request is about the user's own profile for GitHub. Or when information is missing to build other tool calls.
Get member usernames of a specific team in an organization. Limited to organizations accessible with current credentials
Get details of the teams the user is a member of. Limited to organizations accessible with current credentials
Lists all the capabilities that are enabled with the specified toolset, use this to get clarity on whether enabling a toolset would help you to complete a task
List all available toolsets this GitHub MCP server can offer, providing the enabled status of each. Use this when a task could be achieved with a GitHub tool and the currently available tools aren't enough. Call get_toolset_tools with these toolset names to discover specific tools you can call
Output schemas not documented. No visibility into what fields get_me, get_teams, get_team_members, or discovery tools return. LLMs cannot plan downstream tool calls or extract required IDs without knowing response structure.
Discovery tools (enable_toolset, list_available_toolsets, get_toolset_tools) lack guidance on when to invoke them. Descriptions do not explain the workflow: should an LLM always call list_available_toolsets first, or only when a task fails? This creates ambiguity in tool selection.
Parameter descriptions are minimal (avg ~40 chars). E.g., 'Username to get teams for. If not provided, uses the authenticated user.' lacks context on format (email vs handle) and when to provide it. Descriptions should be 50-200 chars with actionable constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
No error handling or recovery guidance. If get_teams fails (e.g., user not found, permission denied), the tool provides no hint on what to do next. Error responses should guide the LLM: 'User not found. Try search_users() with a partial name.'
enable_toolset uses enum constraint but lacks explanation of what each toolset provides. The enum lists 18 toolsets (context, repos, git, issues, pull_requests, users, orgs, actions, code_security, secret_protection, dependabot, notifications, experiments, discussions, gists, security_advisories, projects, stargazers, dynamic, labels) with no descriptions. LLMs cannot reason about which to enable without calling get_toolset_tools first.