{"meta":{"title":"Working with push protection and the GitHub MCP server","intro":"Learn how you are protected from leaking secrets during interactions with the GitHub MCP server, and how to bypass a push protection block if you need to.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/concepts","title":"Concepts"},{"href":"/en/code-security/concepts/secret-security","title":"Secret security"},{"href":"/en/code-security/concepts/secret-security/push-protection-and-the-github-mcp-server","title":"Push protection and the GitHub MCP server"}],"documentType":"article"},"body":"# Working with push protection and the GitHub MCP server\n\nLearn how you are protected from leaking secrets during interactions with the GitHub MCP server, and how to bypass a push protection block if you need to.\n\n## About push protection and the GitHub MCP server\n\nPush protection prevents you from inadvertently exposing secrets, such as tokens, keys and credentials, in your repository.\n\nWhen you're interacting with the GitHub MCP server, push protection blocks secrets in AI-generated responses as well as preventing secrets from being included in any actions you perform, such as creating an issue.\n\nThis protection is on by default for all interactions between the GitHub MCP server and **public repositories**; and between the GitHub MCP server and private repositories covered by GitHub Advanced Security, regardless of whether push protection is enabled on the repository's security settings page.\n\n## Resolving a block\n\nTo resolve the block, you can either:\n\n* **Remove** the secret from the content of your request before trying again.\n* **Bypass the block.** If push protection is enabled for the repository, or you have push protection enabled for your personal account, you'll see an option to bypass the push protection block. You should carefully evaluate if it's safe to include the secret in your request before continuing.\n\n## Further reading\n\n* [Push protection](/en/code-security/concepts/secret-security/push-protection)\n* [About the GitHub MCP server](/en/copilot/concepts/context/mcp#about-the-github-mcp-server)\n* [Scanning for secrets with the GitHub MCP server](/en/code-security/how-tos/use-ghas-with-ai-coding-agents/scan-for-secrets-with-github-mcp-server)"}