Learn how you are protected from leaking secrets during interactions with the GitHub MCP server, and how to bypass a push protection block if you need to.
Push protection prevents you from inadvertently exposing secrets, such as tokens, keys and credentials, in your repository.
When you're interacting with the GitHub MCP server, push protection blocks secrets in AI-generated responses as well as preventing secrets from being included in any actions you perform, such as creating an issue.
This protection is on by default for all interactions between the GitHub MCP server and public repositories; and between the GitHub MCP server and private repositories covered by GitHub Advanced Security, regardless of whether push protection is enabled on the repository's security settings page.
To resolve the block, you can either: