haku-blue/LokiRed
Scan AI-agent and MCP configuration risk, diff pull-request permission changes, or enforce policy.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 26, 2026
- License
- Apache 2.0
Pinned Snippet
uses: haku-blue/lokired@520f9dd434edf1cf192832d060ed44893e959171 # v0.2.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Action mode: scan, diff, or policy-check. scan preserves the original scan-only behavior. | no | scan |
| scan-path | Directory or Git repository to scan. Used as --repo for diff and policy-check modes. | no | . |
| base-ref | Base Git ref for diff and policy-check modes. Defaults to origin/${GITHUB_BASE_REF} on pull_request events. | no | "" |
| head-ref | Head Git ref for diff and policy-check modes. | no | HEAD |
| policy-path | Optional path to a LokiRed policy file for scan mode, such as .lokired/policy.yml. | no | "" |
| baseline-path | Optional path to a LokiRed baseline JSON file for scan mode. | no | "" |
| output-format | Output format for the primary CLI output. scan supports text, json, or sarif; diff and policy-check support text, json, or markdown. | no | text |
| output-file | Optional file path where the primary scan-mode output should be written. | no | "" |
| fail-on | Lowest severity that fails the action. Use none to report only. | no | high |
| write-baseline | Optional path where LokiRed should write a baseline JSON file. | no | "" |
| markdown-summary-path | Optional path for the Markdown pull-request summary produced by diff and policy-check modes. | no | lokired-summary.md |
| json-report-path | Optional path for a JSON report file. Upload it separately if the workflow should retain it as an artifact. | no | "" |
| append-step-summary | Whether diff and policy-check modes append the Markdown summary to GITHUB_STEP_SUMMARY. | no | true |
Outputs
| name | description |
|---|---|
| exit-code | Original LokiRed CLI exit code returned by the selected mode. |
| mode | Action mode that was executed. |
| markdown-summary-path | Markdown summary path written by diff or policy-check mode. |
| json-report-path | JSON report path written when json-report-path is set. |
| blocked | true when policy-check mode returned exit code 1. |