GitHub CLI extension for MCP that provides focused GraphQL and REST API tools.
Six tools with basic GraphQL/REST wrappers around GitHub CLI. All tools have descriptions (10-200 chars, within baseline range) and input schemas with type definitions. However, critical gaps: (1) No output schemas documented, LLMs cannot predict return structure for chaining; (2) Parameter descriptions lack constraints (e.g., 'state' accepts OPEN|CLOSED|MERGED but no enum); (3) No error handling guidance, failures return raw JSON or stderr with no recovery hints; (4) Naming is verb-prefixed but overly specific (gh_graphql_* vs get_repo_info), adds noise without clarity; (5) No pagination support despite GraphQL queries returning lists; (6) Security: GraphQL queries built via string interpolation (owner_repo.split('/')), vulnerable to injection if input not validated. Average tool score: 52/100.
Get details of the authenticated user. Returns: Information about the authenticated user including login, name, and organizations
Get issues for a repository using GraphQL. Example: gh_graphql_issues("block/goose", 5, "OPEN", ["bug", "help wanted"]) Args: owner_repo: Repository in format "owner/repo" limit: Maximum number of issues to return (default: 10) state: Issue state (OPEN, CLOSED) labels: List of labels to filter by Returns: Issue details including title, author, comments, and labels
Get pull requests for a repository using GraphQL. Example: gh_graphql_pull_requests("block/goose", 5) Args: owner_repo: Repository in format "owner/repo" limit: Maximum number of PRs to return (default: 10) state: PR state (OPEN, CLOSED, MERGED) Returns: Pull request details including title, author, reviewers, and status
Get contributors for a repository using GraphQL. Example: gh_graphql_repo_contributors("block/goose", 5) Args: owner_repo: Repository in format "owner/repo" limit: Maximum number of contributors to return (default: 10) Returns: Contributor details including commit count and recent commits
No output schemas documented. LLMs cannot predict return structure (fields, types, nesting) for downstream tool chaining or data extraction. Baseline: 100% of A+ tools document return types.
Parameter 'state' in gh_graphql_pull_requests and gh_graphql_issues lacks enum constraint. Description says 'OPEN, CLOSED, MERGED' but no formal enum, LLMs may hallucinate invalid values like 'pending' or 'draft'.
No error handling guidance. run_gh_command() returns {'success': False, 'error': <stderr>}, raw error text with no recovery hints. LLMs cannot determine if error is retryable, user-fixable, or fatal.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 51 | <=2025-11-25 | v2 |
Get detailed repository information using GraphQL. Example: gh_graphql_repo_info("block/goose") Args: owner_repo: Repository in format "owner/repo" Returns: Repository details including stars, forks, issues, PRs, and languages
Get detailed user profile information using GraphQL. Example: gh_graphql_user_profile("octocat") Args: username: GitHub username Returns: User profile details including repositories, contributions, and social info
GraphQL queries built via string interpolation (e.g., f'query {{ repository(owner: "{owner}", name: "{repo}") }}'), vulnerable to injection if owner_repo contains quotes or special chars. No input validation before split().
No pagination support. GraphQL queries use hardcoded 'first: N' but no cursor/offset or total_count in return. Large result sets will blow context window; no guidance on limits.