iulianvostrut/ContextHound Scan

Static analysis for prompt injection and LLM security risks, with SARIF upload to GitHub Code Scanning

Trust Signals

name	description	required	default
version	Exact context-hound npm version to run. Defaults to the version released with this Action.	no	2.2.2
dir	Directory to scan, relative to the workspace.	no	.
config	Path to a .contexthoundrc.json config file.	no	""
threshold	Fail when the repo risk score is at or above this value (0-100). Empty uses the config file or the default of 60.	no	""
fail-on	Fail on any finding of this severity or above: critical, high or medium.	no	""
min-confidence	Only report rules at or above this confidence: low, medium or high.	no	""
diff	Scan only files changed vs. this git ref (for example origin/main). Needs actions/checkout with fetch-depth: 0. Empty scans everything.	no	""
preset	Comma-separated rule presets, for example owasp-llm-top10 or mcp,agentic. Empty runs all rules.	no	""
sarif-out	Path to write the SARIF report to.	no	results.sarif
upload-sarif	Upload the SARIF report to GitHub Code Scanning (needs security-events: write).	no	true
node-version	Set up this Node.js version first. Empty uses the Node.js already on the runner (20 or later required).	no	""
comment	On pull requests, post a summary comment and update it on every run (needs pull-requests: write). Fork pull requests get a warning instead.	no	false
github-token	Token used to post the pull request comment.	no	${{ github.token }}

name	description
score	Repo risk score (0-100).
findings	Number of findings reported.
passed	true when the scan passed its gates, otherwise false.
sarif-file	Path of the SARIF report.