agent-threat-rule/ATR Scan
Scan MCP configs and SKILL.md files for AI agent security threats using Agent Threat Rules (ATR)
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 13, 2026
- License
- MIT
Pinned Snippet
uses: agent-threat-rule/agent-threat-rules@dc9e58e2b3e6dafc9ecf731be63220196ac2d54c # v3.5.8tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (file or directory) | no | . |
| severity | Minimum severity to report (informational, low, medium, high, critical) | no | medium |
| fail-on-finding | Fail the action if threats are found | no | true |
| sarif-file | Path to write SARIF output file | no | atr-results.sarif |
| upload-sarif | Upload SARIF to GitHub Security tab | no | true |
Outputs
| name | description |
|---|---|
| threat-count | Number of threats found |
| sarif-file | Path to the SARIF output file |