GitHub MCP Server Unauthenticated Nil Pointer DoS

Technical Analysis

The CompletionsHandler function in pkg/github/server.go dereferences params.Ref without a nil check when processing completion/complete requests. Since MCP JSON-RPC requests are processed prior to authentication or token validation, an attacker needs no credentials to reach this code path, only network or transport access to the server's JSON-RPC endpoint. Sending a request with an empty or absent ref field triggers a Go runtime panic, crashing the process and denying service to all legitimate agents and tools relying on that MCP server instance. This does not cross into other agents' contexts or allow code execution, but it does break availability for any downstream agent orchestration depending on this MCP server for GitHub tool access.

Affected Systems

GitHub MCP Server; protocols: MCP

Detection Signatures

• Log pattern: repeated JSON-RPC 'completion/complete' requests with missing or null 'ref' field immediately preceding server crash/restart
• Go runtime panic stack traces referencing pkg/github/server.go CompletionsHandler
• Unexpected process restarts/crash-loop on GitHub MCP Server instances correlated with unauthenticated inbound connections

Remediation Steps

1. 1

   Upgrade GitHub MCP Server

   Update to version 1.1.0 or later, which adds proper nil checks for params.Ref before dereferencing.

2. 2

   Restrict network exposure

   Limit access to the MCP server's JSON-RPC endpoint to trusted networks or authenticated proxies until patched, reducing exposure to unauthenticated crash attempts.

3. 3

   Add process supervision and monitoring

   Deploy process managers with automatic restart and alerting on crash-loops to detect and reduce downtime from this or similar DoS conditions.

4. 4

   Input validation at gateway layer

   If a reverse proxy or API gateway sits in front of the MCP server, add schema validation to reject malformed JSON-RPC requests missing required fields before they reach the application.