What should the client be allowed to read?
Start with the job you need, such as reading a README in a disposable repository you own. GitHub documents local and hosted server options and read-only settings. Choose only the necessary read tools and review which repositories your connection can reach. Read-only access can still reveal private content.
What would you check before using it on a real project?
Compare the tools your client actually displays with the tools you expected to allow. Check the repository and account shown by the client. Confirm whether the client supports your chosen authorization method and whether your organization permits the connection. Use a disposable repository with invented data for any evaluation.
What should a fictional documentation lookup be allowed to see?
Draw a demo repository with a sample README and a separate real project.
- Name the allowed lookupWrite the one read-only operation and the repository it should use.
- Check the rest of the listLeave other repositories and operations outside your test plan.