affaan-m/AgentShield Security Scan
Scan Claude Code configurations for security issues
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 20, 2026
- License
- MIT
Pinned Snippet
uses: affaan-m/agentshield@9bbc007cf5afb562c324bbad4ce6c544420f49f6 # v1.4.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan for Claude Code configurations | no | . |
| min-severity | Minimum severity to report: critical, high, medium, low, info | no | medium |
| fail-on-findings | Fail the action if findings are detected at or above min-severity | no | true |
| format | Output format: terminal, json, markdown, sarif | no | terminal |
| sarif-output | Path to write SARIF results when format is sarif | no | agentshield-results.sarif |
| baseline | Path to an AgentShield baseline JSON file for drift comparison | no | "" |
| save-baseline | Path to write the current scan as a new AgentShield baseline JSON file | no | "" |
| policy | Path to an AgentShield organization policy JSON file | no | "" |
| fail-on-policy | Fail the action when the organization policy is non-compliant | no | true |
| supply-chain | Verify MCP npm/git package provenance and known malicious package risk | no | true |
| supply-chain-online | Query npm registry metadata during supply-chain verification | no | false |
| fail-on-supply-chain | Fail the action when supply-chain verification finds critical or high package risks; defaults to fail-on-findings when unset | no | "" |
| evidence-pack | Path to write an AgentShield evidence pack for audit and security-review handoffs | no | "" |
| verify-evidence-pack | Verify evidence-pack artifact hashes and bundle digest after writing | no | true |
| policy-promotion-manifest | Path to an AgentShield policy export manifest to verify and promote or dry-run | no | "" |
| policy-promotion-pack | Policy pack id to select when the promotion manifest contains multiple packs | no | "" |
| policy-promotion-output | Path to write the promoted active policy when policy-promotion-dry-run is false | no | .agentshield/policy.json |
| policy-promotion-dry-run | Verify promotion review evidence without writing the active policy | no | true |
| fail-on-policy-promotion | Fail the action when policy promotion review items still require action | no | false |
Outputs
| name | description |
|---|---|
| score | Numeric security score (0-100) |
| grade | Letter grade (A-F) |
| total-findings | Total number of findings |
| critical-count | Number of critical findings |
| sarif-path | Path to the generated SARIF file when format is sarif |
| baseline-path | Path to the generated baseline file when save-baseline is set |
| baseline-status | Baseline drift status: not-run, missing, passed, or failed |
| new-findings | Number of findings introduced since the baseline |
| resolved-findings | Number of baseline findings resolved by the current scan |
| unchanged-findings | Number of findings unchanged since the baseline |
| score-delta | Numeric score delta relative to the baseline |
| policy-status | Organization policy status: not-run, compliant, non-compliant, or error |
| policy-violations | Number of unsuppressed organization policy violations |
| supply-chain-status | Supply-chain status: not-run, clean, risky, or error |
| supply-chain-risky-packages | Number of MCP packages with supply-chain risks |
| supply-chain-critical-count | Number of MCP packages with critical supply-chain risk |
| supply-chain-high-count | Number of MCP packages with high supply-chain risk |
| package-manager-hardening-status | Package-manager hardening status: hardened or needs-review |
| package-manager-hardening-findings | Number of package-manager hardening findings |
| package-manager-hardening-critical-count | Number of critical package-manager hardening findings |
| package-manager-hardening-high-count | Number of high package-manager hardening findings |
| package-manager-hardening-registry-credentials | Number of package-manager registry credential findings |
| package-manager-hardening-lifecycle-scripts | Number of package-manager lifecycle-script findings |
| package-manager-hardening-release-age-gates | Number of package-manager release-age gate findings |
| evidence-pack-path | Path to the generated evidence-pack directory |
| evidence-pack-status | Evidence-pack verification status: not-run, passed, failed, or error |
| evidence-pack-digest | Verified evidence-pack bundle digest |
| policy-promotion-status | Policy promotion status: not-run, verified, needs-review, or error |
| policy-promotion-pack | Policy pack selected during promotion |
| policy-promotion-review-items | Number of policy promotion review items |
| policy-promotion-action-required-count | Number of policy promotion review items that still require action |
| policy-promotion-digest | Verified digest for the promoted policy pack |