cloudnua/CloudNua Agent Harness

Wrap AI coding agents with pre/post policy scanning and governance guardrails

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
api-token	CloudNua API token for policy fetching	yes	—
api-url	CloudNua API base URL	no	https://app.cloudnua.com
agent-command	The agent command to execute (e.g., 'copilot-cli suggest'). Omit for scan-only mode (pre-scan + post-scan only, no agent execution).	no	—
policy-types	Comma-separated policy types to enforce: dependency, mcp, compliance. Currently advisory — policy filtering is performed server-side.	no	all
firewall-url	URL of the CloudNua MCP firewall gateway. When set, the harness exposes CLOUDNUA_FIREWALL_URL in the agent subprocess environment. Agent developers must configure their agent to connect to this URL as the MCP server endpoint (HTTP/SSE transport only). The harness does not modify agent config files.	no	—
allow-http	Allow non-TLS URLs for api-url and firewall-url. Intended for local development and testing only — do not enable in production.	no	false
fail-on-violation	Fail the action if blocking violations are found	no	true
github-token	GitHub token for creating Check Runs (needs checks:write permission)	no	${{ github.token }}
cf-access-client-id	Cloudflare Access service-token client ID. Required only when api-url is behind a Cloudflare Access service-token policy. Sent as the CF-Access-Client-Id header on every CloudNua API request. Must be set together with cf-access-client-secret; setting only one is treated as unset and a warning is emitted.	no	—
cf-access-client-secret	Cloudflare Access service-token client secret. Required only when api-url is behind a Cloudflare Access service-token policy. Sent as the CF-Access-Client-Secret header on every CloudNua API request. Treat as a secret — pass via repository secrets, not workflow YAML.	no	—

Outputs

no outputs