Tool-exclusion settings failed to warn when an unknown name was provided. Entry and authority. An operator intended to exclude an effectful tool through a configuration list. Observed mechanism and consequence. The issue identifies silent rejection of unknown --exclude-tools entries and inconsistency with strict option parsing. Limits and status. Reported…
Inspect the ClaimsCase · DiggingBeagle record
GitHub MCP silently ignored misspelled excluded tool names
Tool-exclusion settings failed to warn when an unknown name was provided.
Public disclosure: Nov 9, 2026
Scope
An operator intended to exclude an effectful tool through a configuration list. The issue identifies silent rejection of unknown --exclude-tools entries and inconsistency with strict option parsing.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GITHUB-MCP-TYPO-FILTER; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GITHUB-MCP-TYPO-FILTER-01 · github-mcp-server issue #3761
At a glance
Reported configuration risk, not proof the omitted tool was called or caused a forbidden effect.
Limits and uncertaintyFull account
Tool-exclusion settings failed to warn when an unknown name was provided.
Entry and authority. An operator intended to exclude an effectful tool through a configuration list.
Observed mechanism and consequence. The issue identifies silent rejection of unknown --exclude-tools entries and inconsistency with strict option parsing.
Limits and status. Reported configuration risk, not proof the omitted tool was called or caused a forbidden effect.
The MCP server silently ignored misspelled tool exclusion names. An operator could believe a risky method was hidden while it remained callable. The reported issue concerns validation and diagnostic behavior, not a new privilege granted by GitHub itself. A supplied GitHub token must still be capable of the requested API operation.
Mechanism and trust boundary
- 01
Precondition and trust context
An operator intended to exclude an effectful tool through a configuration list.
- 02
Crossed boundary
The issue identifies silent rejection of unknown --exclude-tools entries and inconsistency with strict option parsing.
- 03
Observed limit
Reported configuration risk, not proof the omitted tool was called or caused a forbidden effect.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
GitHub MCP silently ignored misspelled excluded tool names
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GITHUB-MCP-TYPO-FILTER-01A repository issue reports: The issue identifies silent rejection of unknown --exclude-tools entries and inconsistency with strict option parsing.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3761primary disclosure
Issue #3761, description and reproduction
Controls and mitigations
- Reject unknown tool names at startup, print the effective allow/deny set, and test a known excluded method using a disposable token.
- Prefer independent token-level permission limits to optional server-side exclusions as the final enforcement layer.
Unknowns and contradictions
- Reported configuration risk, not proof the omitted tool was called or caused a forbidden effect.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235