Hello from the github-mcp-server maintainers! ❤️ #1545
Description
Hello from the github-mcp-server maintainers! ❤️
We’re working on two important initiatives to make github-mcp-server more secure and predictable when integrating with LLMs:
🔒 1. Content Filtering
We’re introducing a regex-based content filtering layer that sanitises all user-generated text before it’s passed to the LLM.
This layer uses carefully designed regular expressions to detect and remove hidden or malicious content - such as invisible Unicode characters or hidden HTML attributes - that could otherwise alter model behavior.
🧰 What’s in scope
Filtering will apply to all text responses produced by tools.
🧱 Planned filters
We’re implementing a multi-stage filter pipeline:
- ✅ remove invisible Unicode characters
- ✅ allow only safe HTML tags/attributes
- ✅ restrict allowed url schemes to HTTP and HTTPS
- 🔄 introduce a configurable lockdown mode to ensure only content from users with push access to the repository is returned.
🌍 2. Expanding openWorldHint Coverage
We’re also expanding the use of the openWorldHint annotation across more tools.
This flag indicates whether a tool interacts with external systems or data sources — making tool behavior more transparent and predictable for both developers and LLMs.
This will help downstream clients better reason about trust boundaries and decide when user consent or isolation may be needed.
🚀 What’s Next
Both efforts are in progress — content filtering is being rolled out incrementally, and the openWorldHint expansion will follow shortly.
Related PRs
- removal of invisible Unicode characters #1344)
- allow only safe HTML tags/attributes #1356)
- lockdown mode #1371
💬 Questions, feedback, or implementation ideas? Drop them below — we’d love to hear your thoughts!
Originally posted by @JoannaaKL in #1377