chaoyue0307/mcp-guard MCP Security Scanner
Scan MCP and AI agent tool configuration for risky commands, secrets, and broad permissions.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 11, 2026
- License
- Apache 2.0
Pinned Snippet
uses: chaoyue0307/mcp-guard-action@b48e7885f1c1974f769cbba9a9ca7bd083a41bd4 # v0.4.11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| config | Optional MCP config path to scan. Leave empty to scan default project and user config locations. | no | "" |
| fail-on | Fail the workflow when a finding is at least this severity. Use critical, high, medium, low, or none. | no | high |
| baseline | Optional mcp-guard baseline/allowlist JSON path. Matching findings are accepted and do not fail the workflow. | no | "" |
| policy | Optional mcp-guard policy JSON path. Leave empty to auto-load .mcp-guard-policy.json when present. | no | "" |
| comment-pr | Post or update a pull request comment with the scan summary. Requires pull-requests: write permission. | no | false |
| output-dir | Directory where reports will be written. | no | mcp-guard-report |
| upload-artifact | Upload generated reports as a workflow artifact. | no | true |
| upload-sarif | Upload SARIF to GitHub code scanning. Requires security-events: write permission. | no | false |
| artifact-name | Artifact name for generated reports. | no | mcp-guard-report |
| license-endpoint | Optional Pro license verification endpoint. Leave empty to skip license verification. | no | "" |
| license-key | Optional Pro license key. Pass from a GitHub Secret. | no | "" |
| license-email | Optional buyer email for Pro license verification. | no | "" |
| license-product | Product id for Pro license verification. | no | pro-monthly |
Outputs
| name | description |
|---|---|
| executive-summary | Path to the generated executive summary. |
| markdown-report | Path to the generated Markdown report. |
| html-report | Path to the generated HTML report. |
| json-report | Path to the generated JSON report. |
| sarif-report | Path to the generated SARIF report. |
| remediation-report | Path to the generated remediation plan. |
| remediation-checklist | Path to the generated remediation checklist. |
| audit-manifest | Path to the generated audit pack manifest. |
| exit-code | mcp-guard threshold exit code. |
| comment-report | Path to the generated pull request comment body. |