grcwarlock/agent-cfi
CI gate for AI agents. Fails on tool-call graph drift, new edges, or tainted sinks between main and this PR.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| traces | Path to JSONL trace file produced by this PR's eval run. | yes | — |
| baseline | Path to the committed baseline graph (usually .agent-cfi/baseline.json). | yes | .agent-cfi/baseline.json |
| config | Path to .agent-cfi/config.yaml. | no | .agent-cfi/config.yaml |
| sarif | Output path for SARIF findings. | no | agent-cfi.sarif |
| upload-sarif | Upload SARIF to GitHub Code Scanning. | no | true |
| fail-on | Comma-separated list of finding kinds that fail the build. Overrides config. | no | "" |
| mcp-pins | Path to an MCP pin file produced by `agent-cfi mcp-pin` (optional). Requires mcp-current. | no | "" |
| mcp-current | Path to a JSON file of live MCP tool schemas for this PR (optional). Requires mcp-pins. | no | "" |
| python-version | Python version used to run agent-cfi. | no | 3.12 |
Outputs
no outputs