GitHub MCP Lockdown Mode passed our keyless gate. It leaves token permissions unchanged.

GitHub's official MCP server has a Lockdown Mode that hides issues, pull requests and comments from public-repo authors who lack push access, so a long-running agent reads less prompt-injection bait. We pinned the server at c59e8c199efb, built the binary with no GitHub token, passed 10 lab tests, and parsed the Lockdown and read-only flags out of the pinned README. The catch comes from upstream's own docs: Lockdown Mode changes what the server shows the agent and leaves what the token can do untouched.

The catch

The pinned README calls Lockdown Mode a best-effort content filter and says it is not an authorization boundary. It does not change what the GitHub credential can read or write. Content withheld from one tool response may still be reachable through other tools, or through the GitHub API with the same token. Our parser checks for that sentence and the report records mentions_not_auth_boundary: true.

Two accounts skip the filter on purpose. Content from github-actions[bot] and copilot is always treated as safe, whatever their push access.

Our own gate has a gap as well. go test -race ./... did not finish on macOS, because the race build of pkg/github ran past the package timeout even at 45 minutes. The verbatim upstream suite passed in the Linux CI job instead, so the race result comes from CI and the local result covers the build.

What we ran (keyless)

export DISABLE_TELEMETRY=1 DO_NOT_TRACK=1
uv sync --locked --group dev
bash scripts/vendor-upstream.sh
uv run github-mcp-lockdown --json
uv run pytest -q
bash scripts/upstream-github-mcp.sh

From reports/gate.json, run on October 14, 2026:

The CLI pulled these settings from the pinned README:

How it is wired

The agent calls the GitHub MCP server, and the server calls GitHub with your token. With Lockdown on, the server checks each item's author against the repository's push list. issue_read:get and the pull_request_read reads for a single PR return an error when the author lacks push access, and comment lists drop those authors' entries. Read-only removes the write tools. In HTTP mode the operator's flag is an upper bound, so the X-MCP-Lockdown header can turn Lockdown on for a request and cannot turn it off. Pair it with a fine-grained token scoped to the repos the agent needs, since the filter does nothing to that scope.

Minilab (open source)

Upstream is github/github-mcp-server (33,614 stars, MIT, Go, as of October 14, 2026). Clone the lab, run bash scripts/vendor-upstream.sh and confirm git -C vendor/github-mcp-server rev-parse HEAD prints the pin, then re-run the commands above. The optional scripts/live-mcp-smoke.sh needs a token and stays out of CI.

uv sync --locked --group dev && bash scripts/vendor-upstream.sh && uv run github-mcp-lockdown --json