GitHub MCP Server Adds Secret Scanning to Catch Credentials Before Commits

GitHub Changelog

Mar 20, 2026 · Updated Apr 25, 2026

The GitHub MCP Server now detects exposed secrets in code changes before commits or PRs. Coding agents invoke the scanning directly, returning exact file locations of any credentials found. In public preview for repos with GitHub Secret Protection enabled.

GitHub MCP Server added secret scanning to its toolset, letting coding agents check current changes for exposed credentials before any commit or pull request. When triggered, the agent sends the code to GitHub's secret scanning engine and receives structured results — the exact files and line numbers where secrets appear.

This brings credential detection into the MCP layer, so the check runs inline with the coding session rather than as a post-commit afterthought. Repos need GitHub Secret Protection enabled, and the feature works across MCP-compatible IDEs including GitHub Copilot CLI and VS Code with the optional Advanced Security plugin.

Ask your coding agent to scan current changes before committing — any flagged secrets show up with enough detail to fix them in place.

View the full update on github.blog

GitHub Changelog

@GHchangelogMar 19

The GitHub MCP Server now scans code changes for exposed secrets before commits or PRs. • This feature is in public preview for repos with GitHub Secret Protection enabled. https://t.co/lv3RJWNrU0

View on X

Every HeadsUpAI update is written based on its original source and reviewed before it's published. Read our editorial standards →

Keep reading

GitHub enables custom agents and reusable skills in Visual Studio

GitHub updated Copilot in Visual Studio with support for custom agents defined via .agent.md files and reusable agent skills. This transition turns the IDE into a programmable agentic platform where teams can standardize specialized AI behaviors and securely connect to external data through governed MCP servers.

Chrome for DevelopersMar 15

Chrome DevTools Launches MCP Server for AI Agent Browser Debugging

Chrome DevTools launched a public preview of an MCP server that lets AI coding agents debug web pages directly in Chrome. Agents can now trace performance issues, diagnose network errors, and inspect live DOM and CSS instead of coding blind.

GitHubMar 15

GitHub Copilot Now Connects to Figma via Bidirectional MCP Server

GitHub Copilot now connects to the Figma MCP server for a bidirectional design-to-code workflow in VS Code. Developers can pull design context into code and push rendered UI back as editable frames. Any GitHub Copilot subscriber can use this today.

CopilotKit🪁Apr 13

CopilotKit Launches MCP Server to Equip Coding Agents With Framework Expertise

CopilotKit released a dedicated Model Context Protocol server that provides AI coding agents with direct access to its APIs and best practices. By connecting tools like Cursor and Claude Code to this server, developers can eliminate hallucinations and ensure AI-generated code follows official implementation patterns.