GitHub MCP Server

Integration Overview

GitHub is the code platform where most security teams manage detection-as-code, incident runbooks, and security tooling. With the GitHub MCP server, Panther AI can interact with repositories, issues, pull requests, GitHub Actions, and code security features — all from within the Panther AI chat experience.

Admins configure which MCP servers are available to the organization. Each analyst then connects individually via OAuth and controls which tools Panther AI is allowed to use, with the option to require approval before any action is taken.

Use Cases for the GitHub MCP Server

• Ask Panther AI to open a GitHub issue to track a detection gap identified during triage

• Search repositories for detection logic related to a specific threat or indicator

• Have Panther AI review open pull requests for detection rule changes during an investigation

• Kick off or check the status of a GitHub Actions workflow as part of a response playbook

Connecting the GitHub MCP Server

Navigate to Settings > Panther AI > MCP Servers and select GitHub from the catalog. GitHub requires manual OAuth credentials — you'll create a GitHub App or OAuth App and provide the client ID and secret during setup. GitHub Apps are recommended for more granular, secure permissions.

For full setup instructions, view the GitHub MCP server documentation here.