Github Dependabot MCP server

Fetches Github Dependabot alerts for a specified repository.

Requirements

• uv: A fast Python package installer and resolver. Used to run the script and manage dependencies.
• Github Personal Access Token: Required for authenticating with the Github API. Ensure it has the necessary permissions (e.g., `repo`, `security_events`).

Setup

1. Install `uv`:

Follow the official installation instructions for your OS:

brew install uv

curl -LsSf https://astral.sh/uv/install.sh | sh

irm https://astral.sh/uv/install.ps1 | iex

2. Clone the repository:

git clone git@github.com:avarant/github-dependabot-mcp-server.git
    cd github-dependabot-mcp-server

3. Set up Github Authentication:

First, you need to generate a Github Personal Access Token (PAT) if you don't already have one:

1. Go to your Github Settings -> Developer settings -> Personal access tokens -> Tokens (classic).

2. Click "Generate new token" (or "Generate new token (classic)").

3. Give your token a descriptive name (e.g., "MCP Dependabot Server").

4. Set an expiration date.

5. Select the necessary scopes:

6. Click "Generate token" and copy the generated token immediately. You won't be able to see it again.

Once you have your token, this server requires it to authenticate with the Github API. There are two ways to provide it:

The script will automatically attempt to read the token from your macOS Keychain using the `keyring` library.

Run the following command in your terminal, replacing `` with your actual Github token:

# Make sure you are in the project's virtual environment if you have one active
            # Or install keyring globally if needed: pip install keyring
            keyring set github_mcp_server personal_access_token
            # It will prompt you to enter the token securely.

Alternatively, using the Python module:

python -m keyring set github_mcp_server personal_access_token

1. Open "Keychain Access" (Applications -> Utilities).

2. Select the `login` keychain and the `Passwords` category.

3. Click the `+` button to add a new item.

4. Enter the following details:

5. Click "Add".

If the token is not found in the Keychain, the script will fall back to using the `GITHUB_PERSONAL_ACCESS_TOKEN` environment variable. If you use this method, the script will attempt to store the token in your Keychain for future use (if `keyring` is functional).

4. Update your MCP configuration:

Edit your global `~/.cursor/mcp.json` or create a local `.cursor/mcp.json` file within your project:

{
      "mcpServers": {
        "github": {
          "command": "docker",
          "args": [
            "run",
            "-i",
            "--rm",
            "-e",
            "GITHUB_PERSONAL_ACCESS_TOKEN",
            "mcp/github"
          ],
          "env": {
            // Optional: Set if NOT using Keychain, or as a fallback.
            // "GITHUB_PERSONAL_ACCESS_TOKEN": ""
          }
        },
        "github-dependabot": {
          "command": "uv",
          "args": [
            "--directory",
            "",
            "run",
            "mcp",
            "run",
            "main.py"
          ],
          "env": {
            // Optional: Set if NOT using Keychain, or as a fallback.
            // "GITHUB_PERSONAL_ACCESS_TOKEN": ""
          }
        }
      }
    }

Note: Replace `` with your actual path.

Tools Provided

This MCP server provides the following tool:

• `get_dependabot_alerts(repo_owner: str, repo_name: str)`:

Usage Example

example prompt

Fetch all dependabot alerts for https://github.com/avarant/github-dependabot-mcp-server