Overview

This PR adds an opt-in way to limit issue, comment and PR input from users without push access to a specified repository. This helps mitigate prompt injection attacks when using this repo in headless contexts, especially for coding agents.

Implementation Details

1. Added a new flag--trusted-repo to the CLI which takes a repository in the formatowner/repo
2. Created a context-based content filtering system that checks if users have push access to the trusted repository
3. Updated relevant tools (currentlyGetIssue andGetIssueComments) to filter content based on user permissions
4. The filtering automatically disables itself for private repositories since all users with access to private repos are already trusted

Usage

To enable content filtering, start the server with the trusted repo flag:

github-mcp-server stdio --trusted-repo="owner/repo"

When filtering is enabled, any content from users without push access to the specified repository will be excluded from the results.

Technical Notes

• The implementation caches user permission checks to avoid redundant API calls
• For private repositories, the filter automatically disables itself
• The design allows for easy extension to other tools that handle user-generated content

Fixes#427.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn moreCopilot coding agent tips in the docs.