runtimeadmin/MCPShield MCP Config Scan
Catch risky MCP servers in committed config files and fail the PR before merge. Zero deps, no API key, no network.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| paths | Comma- or newline-separated globs of config files to scan. Leave empty to auto-discover common MCP config filenames repo-wide. | no | "" |
| fail-on | Fail the job if any server is at or above this level: critical | high | medium | low | never. | no | high |
| working-directory | Directory to scan from (relative to the repo root). | no | . |
| comment | Post/update a findings comment on the pull request. Requires `permissions: pull-requests: write` in the calling workflow. | no | false |
| github-token | Token used to post the PR comment. Defaults to the workflow token. | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| max-score | Highest risk score found (0-100). |
| max-level | Highest risk level found (low | medium | high | critical). |
| server-count | Number of MCP servers scanned. |
| findings-json | JSON array of scored servers (name, score, level, factors). |