Github policies

Policies (6)

github · ingress

Block Secrets in GitHub Commits & PRs

Blocks GitHub write tool calls whose payload looks like it carries a live credential into a repository, gist, pull request, or comment.

github secrets dlp ingress soc2

github · ingress

Fence GitHub Access to the Company Org Allowlist

Denies any GitHub tool call whose arguments.owner (read from input.payload.args.

github fence-sensitive-scopes org-allowlist anti-exfil ingress soc2

github · egress

GitHub: Redact Secrets from Read Responses

Scans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…

github redact-secrets secrets dlp redaction egress soc2

github · ingress

Prevent Public Exposure of GitHub Repos, Gists & Forks

Stops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a…

github deny-public-exposure anti-exfil ingress soc2 finserv-comms eu-ai-act

github · ingress

Read-Only GitHub for Non-Engineers

Establishes the least-privilege baseline for the GitHub MCP connector on the agent channel.

github role-gate-writes ingress soc2 sox

github · ingress

Require Human Approval: GitHub Merges & Approvals

Keeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .

github require-human-approval ingress soc2 sox

About these policies

Reusable DTwo policies for the GitHub MCP server — the official github/github-mcp-server remote endpoint (https://api.githubcopilot.com/mcp/) that Claude clients connect to, plus the archived @modelcontextprotocol/server-github community/legacy build still found in brownfield configs. The MCP surface is broad: read tools that reach across every repo the OAuth grant can see (source code, diffs, CI logs, secret-scanning alerts), consolidated *_read/*_write tools that multiplex several REST operations behind a method argument, and externally visible or irreversible write tools (commits, merges, PR approvals, gists, forks, repo creation, Actions triggers). Its risk profile is dominated by IP exfiltration (source code is the crown jewel) and irreversible or externally visible change (a merge, a public gist, a personal-namespace fork of org code) — so tool-name matching alone is insufficient and several of these policies inspect the method and owner arguments as well.

Available policies

Policy	Direction	Purpose	Framework bundles
role-gate-writes-engineering	ingress	Gate every write-class and destructive GitHub tool behind an IdP engineering group; read-only by default.	soc2, sox
require-human-approval-merge	ingress	Deny agent-initiated pull-request merges and approval submissions, keeping a human in the code-review loop.	soc2, sox
fence-scopes-org-allowlist	ingress	Deny any GitHub call whose `owner` is not in the tenant's company-org allowlist.	soc2, gdpr-ccpa
block-secrets-commits	ingress	Deny GitHub write calls whose file content, commit message, PR/issue/comment body, or gist carries a live credential.	soc2, pci-dss, gdpr-ccpa
deny-public-exposure-repos	ingress	Force new repos private, deny public-gist creation, and block personal-namespace forks that would expose org code.	—
redact-secrets-egress	egress	Redact known credential shapes from file-content, code-search, job-log, commit, and PR read responses before they enter agent context.	soc2, gdpr-ccpa

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway. A GitHub MCP server registered as github surfaces tools like github-merge_pull_request, while one registered as gh-mcp surfaces gh-mcp-merge_pull_request. The policies in this directory match on the suffix (merge_pull_request, push_files, create_or_update_file, etc.) so they stay portable across naming conventions and across both the official and archived server builds — but you should always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying. Where the official server consolidates operations behind a method argument (pull_request_review_write, issue_write, label_write, …), the relevant policies read input.payload.args.method rather than trusting the tool name alone.

Identity claims

Most of these policies are single-purpose and require no IdP claims. The identity-gated one (role-gate-writes-engineering) reads input.subject.claims.groups with a placeholder group name (engineering). Replace it with your own IdP group name at import time. Missing claims fail closed for grants (no group → not an engineer → write denied).

Contributing

To add a GitHub policy:

Create apps/github/<policy-slug>/ with policy.md and a tests.yaml test file.
Add a row to the table above.
Declare apps: ["github"] in the policy frontmatter, plus any industry / bundle slugs that apply.
If the policy fits a bundle, link to it from the matching landing page.
Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.