actions-marketplace-validations/AgentAuditKit MCP Security Scan
Security scanner for MCP agent pipelines — 77 rules, OWASP 10/10, SARIF output
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 19, 2026
- License
- MIT
Pinned Snippet
uses: actions-marketplace-validations/sattyamjjain_agent-audit-kit@f60fa9d020a1ce001f86bc26b048dfbb26f6a3a7 # no releases — HEAD as of 2026-07-13tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Project directory to scan | no | . |
| severity | Minimum severity to report (critical, high, medium, low, info) | no | low |
| fail-on | Fail the action if findings at or above this severity (critical, high, medium, low, none) | no | high |
| format | Output format (console, json, sarif) | no | sarif |
| upload-sarif | Upload SARIF results to GitHub Code Scanning | no | true |
| include-user-config | Also scan user-level agent configs (~/.claude/) | no | false |
| rules | Comma-separated rule IDs to run (default: all) | no | "" |
| exclude-rules | Comma-separated rule IDs to skip | no | "" |
| ignore-paths | Comma-separated paths to skip during scan | no | "" |
| config | Path to .agent-audit-kit.yml configuration file | no | "" |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings |
| critical-count | Number of critical findings |
| high-count | Number of high severity findings |
| sarif-file | Path to the SARIF output file |
| exit-code | Exit code from the scan (0=pass, 1=findings exceed threshold, 2=error) |