Suggestion: add a recommended security policy / rate limiting guide

首先查看仓库 README 和现有文档，以找到放置安全指南的合适位置。使用建议的 PAT scopes、proxy rate limits 和破坏性操作阻止作为明确要求，确定此次贡献应为 README 部分、示例策略文件，还是两者都包括。对于 GitHub MCP server 用户，清晰记录推荐的控制措施和示例默认值，即表示完成。

Context

The GitHub MCP server exposes 83 tools, including destructive operations like delete_file, write operations like push_files and merge_pull_request, and resource creation like create_repository. There are no built-in rate limits or access controls — every tool is available to the agent at all times.

For agents in production workflows, this can be risky. An agent stuck in a loop can create dozens of repos or issues. A prompt injection can trigger file deletion. There's no way to say "read everything but don't delete" without external tooling.

Suggestion

Would the maintainers be open to adding a recommended security policy or rate limiting guide to the repo? This could be:

1. A documentation section in the README covering best practices for limiting tool access (e.g. using PATs with minimal scopes, using a proxy for rate limiting)
2. A sample policy file showing recommended rate limits for write operations and blocks on destructive tools

We maintain Intercept, an open-source MCP enforcement proxy, and have published a ready-made policy template for the GitHub MCP server with suggested defaults (file deletion blocked, writes rate limited at 30/hour, repo creation at 5/hour). Happy to contribute a PR if there's interest.

Use case

Developers connecting the GitHub MCP server to Claude Code, Cursor, or other AI agents who want to limit what the agent can do without restricting the PAT scopes (which are too coarse-grained for per-tool control).