thezenmonster/MCP Verdict Check
Check MCP package trust verdicts before deploy. Returns allow, warn, or block for each dependency. Posts capability summary as a PR comment.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| packages | Comma-separated list of npm package names to check. If empty, reads from package.json dependencies. | no | "" |
| fail-on | Fail the check if any package returns this verdict or worse. Options: warn, block. Default: block. | no | block |
| api-url | AgentScore API base URL. | no | https://www.agentscores.xyz |
| api-key | AgentScore repo-scoped API key for central policy, inventory tracking, exceptions, and alerts. Without this, verdict checks still work but remain stateless. | no | "" |
| fail-open | If true, pass the check when the AgentScore API is unreachable. Default: false (fail-closed). | no | false |
Outputs
| name | description |
|---|---|
| results | JSON array of verdict results for each package. |
| passed | Whether all packages passed the check (true/false). |