Add agent security and rate limiting guide#2627
Open
advancedresearcharray wants to merge 3 commits into
Open
Conversation
Document built-in safeguards, recommended deployment profiles, and a sample policy template for MCP enforcement proxies. Closes github#2233. Co-authored-by: Cursor <cursoragent@cursor.com>
Add projects_write to the sample blocked-tools list and cross-link the agent security guide from the host integration docs. Co-authored-by: Cursor <cursoragent@cursor.com>
Add delete_pending_pull_request_review and remove_sub_issue to the sample blocked-tools list, document the full DestructiveHint set in the agent security guide, and cross-link from scope-filtering docs. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add documentation and a sample policy template for limiting what AI agents can do with the GitHub MCP Server in production workflows.
Why
Fixes #2233
Agents connected to the GitHub MCP Server can invoke destructive and write tools without built-in per-tool rate limits. PAT scopes alone are too coarse for per-tool control. This PR adds practical guidance for combining server configuration, authentication best practices, and optional MCP enforcement proxies.
What changed
docs/agent-security-guide.mdcovering built-in safeguards (read-only mode, tool allowlists, exclude-tools), authentication best practices, and MCP enforcement proxies for runtime rate limitingdocs/examples/recommended-security-policy.yamlas a reference policy template with suggested defaults: block destructive tools, rate-limit writes at 30/hour, capcreate_repositoryat 5/hourMCP impact
Security / limits
Tool renaming
Lint & tests
Docs
Test plan