# GitHub Advisory MCP server

> Queries GitHub Security Advisories from a local cloned database to identify vulnerabilities in software ecosystems.

- Repository: https://github.com/microsoft/github-advisory-mcp
- Page: https://hostedmcp.org/servers/microsoft/github-advisory-mcp
- Official: yes
- Transport: —
- Stars: 9
- License: MIT

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `ADVISORY_REPO_PATH` | no | no |  |

## Tools (12)

- `ghsa_id`
- `cve_id`
- `ecosystem`
- `severity`
- `cwes`
- `is_withdrawn`
- `affects`
- `published`
- `updated`
- `per_page`
- `direction`
- `sort`

## FAQ

### What tools are provided by this MCP server?

The server provides two main tools: list_advisories for searching with filters and get_advisory for retrieving detailed information about a specific GHSA ID.

### Does the server require an API key?

No, the server operates on a local trust model using stdio or localhost-only HTTP, and does not require authentication.

### How can I update the advisory database?

The database auto-updates on server start via git pull, or you can manually run git pull inside the advisory-database directory.