actions-marketplace-validations/AgentAuditKit MCP Security Scan

Security scanner for MCP agent pipelines — 77 rules, OWASP 10/10, SARIF output

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Apr 19, 2026
License
MIT

Pinned Snippet

workflow.ymlSHA-pinned
uses: actions-marketplace-validations/sattyamjjain_agent-audit-kit@f60fa9d020a1ce001f86bc26b048dfbb26f6a3a7 # no releases — HEAD as of 2026-07-13

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
pathProject directory to scanno.
severityMinimum severity to report (critical, high, medium, low, info)nolow
fail-onFail the action if findings at or above this severity (critical, high, medium, low, none)nohigh
formatOutput format (console, json, sarif)nosarif
upload-sarifUpload SARIF results to GitHub Code Scanningnotrue
include-user-configAlso scan user-level agent configs (~/.claude/)nofalse
rulesComma-separated rule IDs to run (default: all)no""
exclude-rulesComma-separated rule IDs to skipno""
ignore-pathsComma-separated paths to skip during scanno""
configPath to .agent-audit-kit.yml configuration fileno""
namedescription
findings-countTotal number of findings
critical-countNumber of critical findings
high-countNumber of high severity findings
sarif-filePath to the SARIF output file
exit-codeExit code from the scan (0=pass, 1=findings exceed threshold, 2=error)