---
name: github-org-security-overview
description: Guide an agent through a GitHub organization security investigation using the github_security
  toolset and produce a prioritized executive summary.
allowed-tools: mcp__seizu__github_security__sync_freshness mcp__seizu__github_security__org_overview mcp__seizu__github_security__repo_risk_summary
  mcp__seizu__github_security__top_vulnerabilities mcp__seizu__github_security__actions_hardening_findings
  mcp__seizu__github_security__coverage_gaps mcp__seizu__github_security__identity_access_summary mcp__seizu__github_security__recommendations
---
Investigate the GitHub organization `org` using the github_security user-defined tools. Treat `org` as an explicit required input and do not substitute a default organization.

Inputs — the values arrive in the `## Inputs` block below these instructions:
- `org` — the organization to review; empty matches every organization in the graph.
- `exclude_forks` — whether forked repositories are left out.
- `include_archived` — whether archived repositories are included.
- `limit` — how many rows to request from each ranked query.

Workflow:
1. Call `github_security__sync_freshness` with `org` first. State the newest GitHub sync timestamp and qualify the report if the data looks stale or incomplete.
2. Call `github_security__org_overview` with `org`, `exclude_forks`, and `include_archived`. Establish repository count, visibility split, alert totals, and any caveats around fork metadata.
3. Call `github_security__repo_risk_summary` and identify the highest-risk repositories by critical/high alerts, total open alerts, public exposure, and risk score.
4. Call `github_security__top_vulnerabilities` with `state='open'` and `limit`. Prioritize critical and high findings, then high EPSS/CVSS medium findings if they materially change remediation order.
5. Call `github_security__actions_hardening_findings`. Look for unpinned actions, write-level permissions, publish/deploy workflows, and `pull_request_target` usage.
6. Call `github_security__coverage_gaps`. Identify missing CodeQL, Scorecard, dependency graph coverage, manifests, and language metadata.
7. Call `github_security__identity_access_summary`. Summarize org admins, direct repo admins, and MFA visibility limits without overstating unknown fields.
8. Call `github_security__recommendations` and reconcile its computed recommendations with the evidence from the earlier tools.

Output format:
- Start with a concise security posture summary for `org`.
- Include a `Data Freshness` note with exact sync timestamps when available.
- Include `Top Risks` ordered by severity and likely exploitability.
- Include `Vulnerabilities` with repository, package, severity, CVE/GHSA when present, patch version, and why it matters.
- Include `Misconfigurations and Coverage Gaps` focused on GitHub Actions, scanning, dependency visibility, and identity/access findings.
- Include `Top Recommendations` as a numbered remediation plan, with affected repositories and concrete next actions.
- Call out graph limitations explicitly, especially missing fork metadata, archived state uncertainty, absent MFA fields, or repositories with no dependency manifests.
- Do not claim a repository is forked, archived, protected, or MFA-enforced unless the tool output contains that evidence.
- Keep the response evidence-backed; separate confirmed facts from inferences.