A noncanonical environment Boolean such as yes left the read-only gate disabled. Entry and authority. An operator sets GITHUB_READ_ONLY with an accepted human synonym instead of the parser-recognized literal. Observed mechanism and consequence. A reproducer reported 27 tools with true versus 46 with yes, including mutating tools; actual writes still…
Inspect the ClaimsCase · DiggingBeagle record
GitHub MCP read-only environment values could expose write tools
A noncanonical environment Boolean such as yes left the read-only gate disabled.
Public disclosure: Nov 9, 2026
Scope
An operator sets GITHUB_READ_ONLY with an accepted human synonym instead of the parser-recognized literal. A reproducer reported 27 tools with true versus 46 with yes, including mutating tools; actual writes still require suitable GitHub token authority.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GITHUB-MCP-READ-ONLY-ENV; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GITHUB-MCP-READ-ONLY-ENV-01 · github-mcp-server issue #3747
At a glance
This is a repository issue, not an upstream security advisory or verified production exploit.
Limits and uncertaintyFull account
A noncanonical environment Boolean such as yes left the read-only gate disabled.
Entry and authority. An operator sets GITHUB_READ_ONLY with an accepted human synonym instead of the parser-recognized literal.
Observed mechanism and consequence. A reproducer reported 27 tools with true versus 46 with yes, including mutating tools; actual writes still require suitable GitHub token authority.
Limits and status. This is a repository issue, not an upstream security advisory or verified production exploit.
The GitHub MCP environment parser recognized a narrow set of Boolean spellings. Values such as yes or on that operators reasonably use for read-only mode were silently treated as disabled, so additional write-capable tools remained advertised. This is a configuration parsing defect. Whether any of those tools can change a repository still depends on the separate GitHub token's actual write scope.
Mechanism and trust boundary
- 01
Precondition and trust context
An operator sets GITHUB_READ_ONLY with an accepted human synonym instead of the parser-recognized literal.
- 02
Crossed boundary
A reproducer reported 27 tools with true versus 46 with yes, including mutating tools; actual writes still require suitable GitHub token authority.
- 03
Observed limit
This is a repository issue, not an upstream security advisory or verified production exploit.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
GitHub MCP read-only environment values could expose write tools
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GITHUB-MCP-READ-ONLY-ENV-01A repository issue reports: A reproducer reported 27 tools with true versus 46 with yes, including mutating tools; actual writes still require suitable GitHub token authority.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3747primary disclosure
Issue #3747, description and reproduction
Controls and mitigations
- Fail closed or reject unknown Boolean spellings, and verify the effective tool list after configuration loads.
- Enforce read-only GitHub credentials separately from MCP tool-list filters.
Unknowns and contradictions
- This is a repository issue, not an upstream security advisory or verified production exploit.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235