Security-focused plugin that brings GitHub Advanced Security capabilities into AI coding workflows through skills and MCP integrations.

The plugin helps agents identify and prevent credential exposure during development by:

• Scanning code snippets, files, and git changes for potential secrets
• Using GitHub secret detection patterns through MCP tooling
• Supporting pre-commit checks to catch leaked credentials early

• Skills - reusable capabilities that AI agents can invoke to perform specific tasks

This plugin requires the GitHub MCP Server. It works with any MCP-compatible AI agent or client, and is not limited to GitHub Copilot.

Authentication: When using GitHub Copilot, authentication is handled automatically. For other clients (e.g., Cursor), you must include an Authorization header with a Bearer ${GITHUB_TOKEN}.

By default, Copilot CPI and VS Code don't enable the toolsets required by the skills in this repository. To simplify setup and usage, this plugin includes a preconfigured .mcp.json file with the appropriate defaults.

Install or enable the plugin in your preferred AI agent or client. For example, VS Code, using Agent plugins or using Copilot CLI via copilot plugins install. This plugin is already accessible in the default marketplaces exposed by both.

Ask your AI coding agent to use these security capabilities in natural language. For example:

You: "Scan my staged changes for secrets before I commit"
Agent: Uses the secret scanning capability and reports the result
✅ Staged changes are clean

We'd love your contributions! Please read our Contributing Guide for details on how to submit pull requests.

This project is licensed under the MIT License.