tiagosilva07/Zyrax Guard
Zyrax Guard CI: audit AI agent configs (prompt injection, rogue MCP servers) + gate risky dependencies on every PR.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| ecosystem | Package ecosystem: npm, pypi, or crates. | — | npm |
| lockfile | Lockfile to scan. Empty uses the ecosystem default (package-lock.json / poetry.lock / Cargo.lock). | — | "" |
| base | Base lockfile to diff against (scan only added/changed deps). Empty: on a pull_request, the base ref's lockfile is used automatically when available; otherwise the whole lockfile is scanned. | — | "" |
| strict | Treat WARN as a failure (not just BLOCK). | — | false |
| deep | Download each added dependency's artifact and statically inspect its install/build scripts. | — | false |
| version | Zyrax Guard release to install (e.g. v0.5.0). 'latest' resolves the newest release. | — | latest |
| sarif-file | If set, write SARIF results to this path (for upload to GitHub Code Scanning). Empty: human-readable output in the log. | — | "" |
| fail-on-block | Fail the job when a dependency is blocked. Set false to report without failing. | — | true |
| args | Extra raw arguments appended to the scan command. | — | "" |
| scan | What to scan: deps (dependency PR-gate), agents (audit AI agent configs), or both. | — | both |
| agents-sarif-file | If set, write the agent-config SARIF here (upload to GitHub Code Scanning under its own category). | — | "" |
Outputs
no outputs