rfounds/Ferrok MCP Security Scan
Scan MCP server configurations for security vulnerabilities using the Ferrok API. Maps findings to the OWASP MCP Top 10 framework.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-key | Your Ferrok API key (get one free at ferrok.dev/dashboard). Store as a GitHub secret. | yes | — |
| config-path | Path to MCP server config JSON file(s) to scan. Supports glob patterns (e.g., 'mcp-servers/*.json'). | no | "" |
| config-json | Inline MCP server config JSON to scan (alternative to config-path). | no | "" |
| severity-threshold | Minimum severity to cause a workflow failure: critical, high, medium, low, or none. | no | high |
| fail-on-findings | Whether to fail the workflow when findings exceed the severity threshold. | no | true |
| api-url | Ferrok API base URL (override for self-hosted instances). | no | https://api.ferrok.dev |
| include-recommendations | Include remediation recommendations in scan results. | no | true |
Outputs
| name | description |
|---|---|
| score | Overall security score (0-100) |
| grade | Letter grade (A+ through F) |
| total-findings | Total number of findings |
| critical-count | Number of critical-severity findings |
| high-count | Number of high-severity findings |
| medium-count | Number of medium-severity findings |
| low-count | Number of low-severity findings |
| pass-fail | PASS or FAIL for CI/CD gating |
| report-json | Path to the full JSON scan report |
| scan-id | Unique scan identifier |