navalerakesh/MCP Validator
Validate MCP servers in GitHub Actions with policy gates, workflow summaries, annotations, and artifacts.
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored May 25, 2026
- Maintenance Recency
- Activelast commit May 23, 2026
- License
- MIT
Pinned Snippet
uses: navalerakesh/mcp-validation-security@3554e7556d05623d2e4c4df122b78a80ad45db50 # v1.1.24-gh-marketplacetags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| server | MCP server endpoint or STDIO command. | no | — |
| config-file | Optional path to a validation config file. | no | — |
| access | Access profile passed to mcpval. | no | public |
| token | Optional bearer token for authenticated servers. | no | — |
| interactive | Whether to allow interactive authentication. | no | false |
| output-dir | Directory where validation artifacts will be written. | no | ./mcp-validation-results |
| mcpspec | Optional MCP spec profile. | no | — |
| policy | Validation policy mode. | no | balanced |
| max-concurrency | Optional max in-flight request count. | no | — |
| version | Optional McpVal NuGet version to install. Defaults to latest published version. | no | — |
| github-summary | Emit GitHub step summary markdown. | no | true |
| github-annotations | Emit GitHub workflow error, warning, and notice annotations. | no | true |
| upload-artifacts | Upload the output directory as a workflow artifact. | no | true |
| artifact-name | Artifact name used when uploading results. | no | mcpval-results |
| extra-args | Additional raw arguments appended to the validate command. | no | — |
Outputs
no outputs