A development team deploys GitHub official remote MCP server to give their Copilot agent access to repository operations. Their security engineer asks: which security controls does the GitHub remote MCP server handle automatically, and which must the team configure themselves? Which statement correctly describes this division of responsibility?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The GitHub remote MCP server is like a secure hotel front desk — it checks your ID (OAuth), encrypts the conversation (HTTPS), and stops you from overwhelming the lobby (rate limiting). But the hotel does not decide which guest rooms you booked or what the house rules say. Option A is correct: the MCP server handles transport-layer security, but the team still owns repository access scope, branch protection configuration, and the agent system prompt guardrails that prevent the agent from requesting operations beyond its mandate.
Full explanation below image
Full Explanation
Understanding the shared responsibility model for remote MCP servers is essential for secure agent deployments. GitHub official remote MCP server handles several security concerns at the infrastructure level: OAuth 2.0 authentication flows (the server manages token exchange and refresh), HTTPS transport encryption for all MCP protocol traffic, and rate limiting aligned with GitHub API limits to prevent the agent from triggering abuse protections.
Option A correctly describes this boundary. The team retains responsibility for application-layer controls: configuring the GitHub App installation to restrict which repositories are accessible (this is done in the GitHub App settings, not the MCP server), enforcing branch protection rules on the target repositories (configured in repository settings), and crafting the agent system prompt to restrict what tool calls the agent is permitted to initiate. The MCP server executes whatever tool calls the agent requests within its authenticated scope — it does not second-guess whether a particular operation fits the agent intended use case.
Option B overstates the MCP server capabilities. The server does not enforce business-level restrictions like preventing the agent from cloning every repository it has access to, or blocking force-pushes that branch protection rules would catch. Branch protection is a GitHub repository setting, not an MCP server feature.
Option C is wrong in the opposite direction. The GitHub remote MCP server does include a complete OAuth flow. Developers do not need to implement their own OAuth layer — this is one of the key advantages of using the official remote server over running a local MCP server.
Option D is inaccurate. The remote MCP server communicates over HTTPS and implements rate limiting natively. A WAF is not required for standard deployments, though it can be added for additional defense-in-depth in high-security environments.