agentsid-dev/AgentsID MCP Scan
Scan MCP servers for security issues. Posts a PR comment, renders a workflow summary, and uploads findings to the GitHub Security tab.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- None
Pinned Snippet
uses: agentsid-dev/agentsid@73e7606c9204388b882c95e173ddf54c56fd2c6b # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| target | MCP server to scan (npx command or HTTP URL) | yes | — |
| env | Environment variables for the server (KEY=VALUE, one per line) | no | "" |
| fail-on-grade | Fail the check if grade is at or below this letter (A, B, C, D, F) | no | "" |
| comment | Post results as a PR comment (true/false) | no | true |
| upload-sarif | Upload findings to the GitHub Security tab as SARIF (true/false). Requires security-events: write permission on the consuming workflow. | no | true |
| token | GitHub token for posting PR comments | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| grade | Overall letter grade (A-F) |
| score | Numeric score (0-100) |
| findings-critical | Number of critical findings |
| findings-high | Number of high findings |
| report-path | Absolute path to the full JSON report file |