proofofwork-agency/ToolPin CI

Verify an MCP lockfile with toolpin ci.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 10, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: proofofwork-agency/toolpin@0c17016d9437f74ffef31d2ec7db63577e8464c5 # v0.5.4

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
working-directory	Directory that contains mcp-lock.json.	no	.
file	Lockfile path, relative to working-directory.	no	mcp-lock.json
source	Optional registry source passed to --source. Leave empty to use each lockfile entry's recorded source, falling back to all for older locks.	no	""
live	Fetch live registry data instead of relying on local cache.	no	true
verify	Run verification before comparing locked plans.	no	""
require-verified	Require fresh ToolPin-verified artifact evidence when verification runs.	no	""
strict	Preset for verify + require-verified. Explicit conflicting inputs fail closed.	no	false
doctor	Run toolpin doctor before ci. auto runs when known project MCP client config files exist.	no	auto
sarif	Write toolpin ci SARIF output to toolpin-ci.sarif and expose sarif-path.	no	false
expect-digest	Expected whole-lock digest from a trusted out-of-band source.	no	""
signature	Detached signature path.	no	""
public-key	Public key path used with signature.	no	""
toolpin-version	Optional npm version specifier for the published @proofofwork-agency/toolpin npm package. Leave empty to install from this action source.	no	""
policy	Policy file path.	no	.toolpin/policy.json
no-policy	Pass --no-policy and skip policy enforcement.	no	false
timeout	Live verification timeout in milliseconds.	no	15000
skip-live-verification	Pass --skip-live-verification when verify is enabled.	no	false
allow-execute	Pass --allow-execute so live verification may execute package targets (required to re-verify live capability pins on package entries).	no	false

Outputs

name	description
sarif-path	Path to SARIF output when sarif is true.