
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
github-brain
Advanced tools
GitHub Brain is an experimental MCP server for summarizing GitHub discussions, issues, and pull requests. Answer questions like:
https://github.com/user-attachments/assets/80910025-9d58-4367-af00-bf4c51e6ce86
GitHub Brain complements (but does not replace) the official GitHub MCP server. It stores GitHub data in a local database for:

GitHub Brain also includes a web-based UI for ultra-fast search:

And a Raycast extension:

GitHub Brain is programmed in Markdown.
npm i -g github-brain
Or use npx github-brain to run without installing globally.
github-brain <command> [<args>]
Workflow:
pull to populate the local databasemcp to start the MCP serverRe-run pull anytime to update the database with new GitHub data.
Each command has its own arguments. Some can be set via environment variables. The app will also load environment variables from a .env file in the GitHub Brain's home directory - ~/.github-brain by default.
You can change the home directory with the -m argument available for all commands.
GITHUB_TOKEN=your_github_token
ORGANIZATION=my-org
pullPopulate the local database with GitHub data.
Example:
github-brain pull -o my-org
The first run may take a while. Subsequent runs are faster, fetching only new data.
| Argument | Variable | Description |
|---|---|---|
-t | GITHUB_TOKEN | Your GitHub personal token to access the API. Required. |
-o | ORGANIZATION | The GitHub organization to pull data from. Required. |
-m | Home directory. Default: ~/.github-brain (or checkout directory if run via scripts/run). | |
-i | Pull only selected entities: repositories, discussions, issues, pull-requests (comma-separated). | |
-f | Remove all data before pulling. With -i, removes only specified items. | |
-e | EXCLUDED_REPOSITORIES | Repositories to exclude (comma-separated). Useful for large repos not relevant to your analysis. |
Use [fine-grained personal access tokens](https://github.com/settings/personal-access-tokens).
**Private organizations:** Token needs read access to discussions, issues, metadata, and pull requests. [Generate token](https://github.com/settings/personal-access-tokens/new?name=github-brain&description=http%3A%2F%2Fgithub.com%2Fwham%2Fgithub-brain&issues=read&pull_requests=read&discussions=read).
**Public organizations:** Any token works (data is publicly accessible).
mcpStart the MCP server using the local database.
Example:
github-brain mcp -o my-org
| Argument | Variable | Description |
|---|---|---|
-o | ORGANIZATION | GitHub organization. Required. |
-m | Home directory. Default: ~/.github-brain (or checkout directory if run via scripts/run). |
uiStart the web UI for quick searches (alternative to MCP).
github-brain ui -o my-org
| Argument | Variable | Description |
|---|---|---|
-o | ORGANIZATION | GitHub organization. Required. |
-m | Home directory. Default: ~/.github-brain (or checkout directory if run via scripts/run). | |
-p | UI_PORT | Port. Default: 8080. |
Version:
github-brain --version
Displays the current version (commit hash and build date).
Add to the Claude MCP configuration file:
{
"mcpServers": {
"github-brain": {
"type": "stdio",
"command": "github-brain",
"args": ["mcp"]
}
}
Merge with existing mcpServers if present.
Add to the VS Code MCP configuration file:
{
"servers": {
"github-brain": {
"type": "stdio",
"command": "github-brain",
"args": ["mcp"],
"version": "0.0.1"
}
}
}
Merge with existing servers if present.
Run the Raycast extension with:
scripts/raycast
The extension uses the MCP server to search GitHub data.
scripts/run builds and runs github-brain with the checkout directory as home (database in db/, config in .env).
FAQs
MCP server for searching GitHub discussions, issues, and pull requests
The npm package github-brain receives a total of 3 weekly downloads. As such, github-brain popularity was classified as not popular.
We found that github-brain demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.