Intake notes: audit deferred until it can be run properly. It’s a Go binary that ships via Docker or the GitHub-hosted remote, and a verdict here means actually booting one of those paths, not reading source alone. When vetted: compare the remote-hosted path against the local Docker path, count the (large) tool surface it injects, and exercise the read-only and toolset-scoping configuration.
github-mcp-server
• Not yet vettedGitHub's official MCP server: repos, issues, pull requests, and Actions through the GitHub API, hosted remotely or run locally in Docker.
In the intake queue. Listed with facts only; no verdict until a human runs it.
by GitHub MCP server DevOps
Shipped today passing liveness · checked Oct 19, 2026
Commit activity · last 52 weeks
Stars34k
LanguageGo
LicenseMIT
Open issues376
Pricingfree
ListedJul 11, 2026
Facts pulled from the source repo and refreshed nightly. Stars are a data point, not our ranking. We don't order by popularity.
Runs in
| Harness | Support | Notes |
|---|---|---|
| Claude Code | untested | — |
| Any MCP client | untested | — |
Support levels reflect what we actually ran, not what the README claims. untested means exactly that.
What a vet will check
- Whether it can act or write when told not to (read-only and scope enforcement)
- What it injects per session: token cost and the size of the tool surface
- Where your data goes: any call that leaves your machine, disclosed or not
No verdict is published until a human installs it, runs it, and audits what it injects. How vetting works →
More in DevOps
posthog-mcp MCP server “This is not a read-only tool, and its reach is exactly the scopes of the personal API key you hand it. Of its 44 tools, 26 read and 18 write, and 5 of those delete production objects (delete-feature-flag, insight-delete, dashboard-delete, experiment-delete, survey-delete). The safety is real and server-enforced: every tool declares its required_scopes and PostHog checks them, so a key minted with only :read scopes mechanically blocks every write and delete. So mint one that way. Create a read-scoped personal API key unless you specifically want an agent creating feature flags in your live project. Second thing to know: the default install points at https://mcp.posthog.com/mcp, a hosted Cloudflare Worker, so your key and query results transit PostHog's own infrastructure (you already trust them with this data, and you can self-host by pointing POSTHOG_BASE_URL at your own worker). Two smaller notes: the docs-search tool sends your question to api.inkeep.com, a third party, and the server reports its own tool-call usage back to PostHog via posthog-node. No filesystem access, no other egress.”
sentry-mcp MCP server “Official, and it connects the way you'd hope. On sentry.io you don't paste a token, you approve a device-code login; self-hosted takes a token and a --host. Once connected it reads your org's real issues, errors, and traces. That's the point, and also the thing to be deliberate about. Production error data is where stack traces, user emails, and other PII live, and this pulls it into the model's context. Fine for most work, worth a thought under strict data rules. Two smaller notes. The server reports its own telemetry to Sentry via a built-in DSN (Sentry using Sentry; override it with --sentry-dsn if you'd rather it didn't), and --agent mode collapses the tool surface to a single use_sentry tool, which is the lighter way to run it inside an agent.”
desktop-commander-mcp MCP server “The default configuration hands the agent the whole filesystem. allowedDirectories ships as an empty array, and the server's own set_config_value tool documents what that means: "allows full access to the entire file system, regardless of the operating system." Nothing in the install path scopes it down, unlike postgres-mcp's --access-mode restricted flag: you have to know to set allowedDirectories yourself after install. Shell execution is denylist-based, not sandboxed: blockedCommands stops ~30 admin and disk commands (sudo, dd, mkfs, shutdown), not arbitrary scripts. Telemetry is on by default too (telemetryEnabled: true, // Default to opt-out approach), sending tool names, client info, and sanitized errors to telemetry.desktopcommander.app on every call, opt out with DESKTOP_COMMANDER_DISABLE_TELEMETRY=1. The project's own source flags that endpoint as unauthenticated: a TODO(security) comment in capture.ts says the bearer token was removed and anyone can now post events into it. None of this was confirmed against a live boot: this session's npm install/npx were denied by the harness (an unattended-session guard, not a tool defect), so the read is a full static audit of the pinned source, not a run. Set allowedDirectories to a real path and the telemetry env var before pointing this at anything you care about.”
aws-mcp MCP server Open source MCP Servers for AWS