
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@paretools/github
Advanced tools
MCP server for GitHub — structured PR, issue, and Actions data for AI agents
Structured, token-efficient GitHub operations for AI agents. Wraps the GitHub CLI (gh) with typed JSON output.
Part of the Pare suite of MCP servers.
| Tool | Description |
|---|---|
pr-view | View PR details with checks, review decision, diff stats |
pr-list | List PRs with state/author/label filters |
pr-create | Create a pull request with title, body, base/head |
issue-view | View issue details with labels, assignees, body |
issue-list | List issues with state/label/assignee filters |
issue-create | Create an issue with title, body, labels |
run-view | View workflow run details with job statuses |
run-list | List workflow runs with branch/status filters |
secret-set | Set a repo, org, or environment GitHub Actions secret |
secret-list | List secret names and metadata; values are never returned |
secret-delete | Delete a repo, org, or environment GitHub Actions secret |
variable-set | Set a repo, org, or environment GitHub Actions variable |
variable-list | List variable names, values, and metadata |
variable-delete | Delete a repo, org, or environment GitHub Actions variable |
npx -y @paretools/github
Add to your MCP client config:
{
"mcpServers": {
"pare-github": {
"command": "npx",
"args": ["-y", "@paretools/github"]
}
}
}
pr-view output:
{
"number": 42,
"state": "OPEN",
"title": "Add search functionality",
"mergeable": "MERGEABLE",
"reviewDecision": "APPROVED",
"checks": [{ "name": "CI", "status": "COMPLETED", "conclusion": "SUCCESS" }],
"url": "https://github.com/owner/repo/pull/42",
"headBranch": "feat/search",
"baseBranch": "main",
"additions": 150,
"deletions": 20,
"changedFiles": 5
}
secret-set input:
{
"name": "MAXMIND_LICENSE_KEY",
"value": "license-key-value",
"repo": "owner/repo"
}
Secret values are sent to gh secret set via stdin and are not returned in structured output. For organization scope, pass org and optional visibility / repos; for environment scope, pass repo and env.
variable-list output:
{
"scope": "repo",
"variables": [
{
"name": "PUBLIC_URL",
"value": "https://example.com",
"updatedAt": "2026-01-01T00:00:00Z"
}
]
}
gh) installed and authenticated (gh auth login)Works with any MCP-compatible client: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code / GitHub Copilot, Cline, Roo Code, Zed, Continue.dev, Gemini CLI, OpenAI Codex
FAQs
MCP server for GitHub — structured PR, issue, and Actions data for AI agents
The npm package @paretools/github receives a total of 111 weekly downloads. As such, @paretools/github popularity was classified as not popular.
We found that @paretools/github demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.