github_check_pat_usage

MCP tool from Github Security MCP by badchars

Classic vs fine-grained PAT usage

How to use it

github_check_pat_usage is exposed by the Github Security MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the github_check_pat_usage tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install Github Security MCP

$claude mcp add github-security -- bun run /path/to/github-security-mcp/src/index.ts

FULL GITHUB SECURITY MCP LISTING

Other tools in Github Security MCP (38)

github_audit_report

Full markdown or JSON audit report

github_audit_summary

Aggregate findings by category, severity, status

github_check_app_permissions

GitHub App permission scope review

github_check_collaborators

External collaborator access audit

github_check_dependabot_updates

Dependabot security updates configuration

github_check_dependency_graph

Dependency graph enablement

github_check_org_apps

OAuth credential authorizations, GitHub App installation permissions

github_check_org_audit_log

Suspicious audit log activity (Enterprise)

github_check_org_members

Outside collaborators, stale member detection

github_check_org_security

2FA enforcement, default repo visibility, member creation privileges

github_check_org_sso

SSO/SAML configuration via GraphQL

github_check_org_webhooks

Insecure webhook URLs (HTTP, no secret)

github_check_push_protection

Push protection bypass tracking

github_check_repo_branch_protection

Branch protection rules on default branch

github_check_repo_code_scanning

CodeQL / code scanning enabled, open alerts

github_check_repo_codeowners

CODEOWNERS file presence and enforcement

github_check_repo_dependabot

Dependabot enabled, critical alert triage

github_check_repo_deploy_keys

Deploy key permissions (read-only vs read-write)

github_check_repo_secrets

Secret scanning and push protection enablement

github_check_repo_settings

SECURITY.md, private vulnerability reporting, fork restrictions

github_check_repo_webhooks

Insecure repo-level webhook URLs

github_check_sbom

SBOM generation capability

github_check_secret_patterns

Custom secret pattern configuration

github_check_secret_scanning

Coverage gaps and unresolved alerts

github_check_secret_scoping

Environment, repo, and org-level secret scoping

github_check_team_permissions

Team permission levels across repos

github_check_vulnerabilities

Known vulnerabilities, critical unfixed > 90 days

github_check_workflow_environments

Missing environment protection rules

github_check_workflow_injection

Script injection via ${{ github.event. }} in run: blocks

github_check_workflow_oidc

OIDC subject claim customization

github_check_workflow_permissions

GITHUBTOKEN default permission scope

github_check_workflow_pinning

Unpinned third-party actions (tag vs SHA)

github_check_workflow_pr_target

pullrequesttarget + checkout pattern (critical)

github_check_workflow_runners

Self-hosted runner exposure

github_check_workflow_secrets

Secret exfiltration patterns in workflows

github_list_checks

Browse all 45 checks, filter by category/severity

github_list_org_repos

List all repos in an org with security metadata

Execute all checks for an org/repo