Hello from the github-mcp-server maintainers! ❤️

We’re working on two important initiatives to makegithub-mcp-server more secure and predictable when integrating with LLMs:

🔒 1. Content Filtering

We’re introducing a regex-based content filtering layer that sanitises all user-generated text before it’s passed to the LLM.
This layer uses carefully designed regular expressions to detect and remove hidden or malicious content - such as invisible Unicode characters or hidden HTML attributes - that could otherwise alter model behavior.

🧰 What’s in scope

Filtering will apply to all text responses produced by tools.

🧱 Planned filters

We’re implementing a multi-stage filter pipeline:

• ✅ remove invisible Unicode characters
• ✅ allow only safe HTML tags/attributes
• ✅ restrict allowed url schemes to HTTP and HTTPS
• 🔄 introduce a configurable lockdown mode to ensure only content from users with push access to the repository is returned.

🌍 2. Expanding openWorldHint Coverage

We’re also expanding the use of theopenWorldHint annotation across more tools.
This flag indicates whether a tool interacts with external systems or data sources — making tool behavior more transparent and predictable for both developers and LLMs.
This will help downstream clients better reason about trust boundaries and decide when user consent or isolation may be needed.

🚀 What’s Next

Both efforts are in progress — content filtering is being rolled out incrementally, and the openWorldHint expansion will follow shortly.

Related PRs

• removal of invisible Unicode characters#1344)
• allow only safe HTML tags/attributes#1356)
• lockdown mode#1371

💬 Questions, feedback, or implementation ideas? Drop them below — we’d love to hear your thoughts!