nhomyk/MCP Security Scan
Scan MCP servers & AI agents for tool poisoning, SSRF, prompt injection & DataFlow taint. SARIF output. No API key.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| repo-path | Path to the repository to scan (default: current directory) | no | . |
| fail-on-critical | Exit with code 1 if any critical findings are discovered | no | false |
| sarif-output | Filename for the SARIF output file | no | mcp-scan-results.sarif |
| upload-sarif | Upload SARIF to GitHub Code Scanning (requires security-events: write permission in the calling workflow) | no | true |
| category | GitHub Code Scanning SARIF category (useful when running multiple scans) | no | mcp-security |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings across all scan types |
| risk-level | Overall risk level: low | medium | high | critical |
| critical-count | Number of critical findings |
| sarif-file | Path to the generated SARIF output file |