vulnex/VASO Security Scan
Scan AI agent installations and MCP server configurations for security issues
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Git ref to install from github:vulnex/vaso (tag like v0.4.2, branch, or commit SHA). | no | v0.4.12 |
| agent | Scan a single agent only (openclaw, nanoclaw, picoclaw, ironclaw, nanobot, zeroclaw, nemoclaw, hermes, claude-code, codex). Omit to scan all detected agents. | no | "" |
| format | Output format: terminal, json, sarif, markdown, or html. | no | sarif |
| output | Path for the scan report. Defaults to vaso-results.<format-extension>. | no | "" |
| fail-on | Exit non-zero when findings reach this severity: critical (default), warning, info, or none. | no | critical |
| working-directory | Directory to run vaso from. Defaults to the workspace root. | no | . |
| upload-sarif | When format is sarif, also upload the report to GitHub Code Scanning. Defaults to true. | no | true |
| debug | Enable --debug to print full stack traces on errors. | no | false |
| extra-args | Additional CLI flags appended verbatim to vaso scan (escape hatch for flags this action does not model). | no | "" |
Outputs
| name | description |
|---|---|
| report-path | Absolute path to the generated scan report. |