GitHub Actions Security Audit MCP Server

by tylerscomic-lab Your server? Claim it

answering

GitHub Actions Security Audit is answering right now. Last checked 12 min ago. Last commit 2 Oct 2026.

Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.

Uptime history 11 days of history

11 days agonow

100.0%

Uptime 24h

91 of 91 checks

—

Tools

hidden behind auth

532 ms

Response time

average over 24h

Stars

last commit 2 Oct 2026

What the code does

We read the source, 5 d ago · rules ccca72095570

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Deletes files or strips permissions server.js:196

…ted}) and is substituted into the shell script text before the shell runs it -- it is not passed as a variable, so \`"; rm -rf . #\` in a PR title or issue comment becomes literal shell syntax. This is the single most common real-world GitHub Actions vulnerability.`,

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch GitHub Actions Security Audit and you get told the day something new turns up.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 12 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add github-actions-audit-mcp --transport http https://github-actions-audit-mcp.mcpize.run/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "github-actions-audit-mcp": {
      "url": "https://github-actions-audit-mcp.mcpize.run/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.github-actions-audit-mcp]
url = "https://github-actions-audit-mcp.mcpize.run/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "github-actions-audit-mcp": {
      "url": "https://github-actions-audit-mcp.mcpize.run/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "github-actions-audit-mcp": {
      "url": "https://github-actions-audit-mcp.mcpize.run/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URL	Transport	State	Latency	Checked
https://github-actions-audit-mcp.mcpize.run/mcp	streamable-http	sign-in	425 ms	12 min ago

Alternatives to GitHub Actions Security Audit

same job, measured the same way

GitHub Actions Audit

by unbearabledev

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.

answering

Gha Intel

by barissozudogru

Workflow timing analysis, configuration audit and billing insight for GitHub Actions.

19 installs/wk local only

Taskbounty Check

by eliottreich

Local GitHub Actions/CI maintenance check (action pinning, token perms). Not a full security audit.

39 installs/wk local only

GitHub

by aifity

Connect AI assistants to GitHub - manage repos, issues, PRs, workflows, and git operations.

local only

OpenAPI Lint

by basitalisandhu

Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.

local only

okffs

by neturely

MCP server connecting Claude Code to GitHub for an issue to branch to PR to close workflow.

55 installs/wk local only

Agentic SDLC MCP

by sakuracianna

Agentic SDLC governance and security controls for AI coding agents working with GitHub.

65 installs/wk local only

Regulatory Signals

by rikocr8orh8

Audit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.

22 installs/wk local only

GitHub Actions Security Audit — questions

Answers built from our own checks of this server.

Why is there no tool list for GitHub Actions Security Audit?

The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.

Is GitHub Actions Security Audit working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 532 ms. The bar chart above shows every period we have measured.

How do I connect GitHub Actions Security Audit?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.

How do you sign in to GitHub Actions Security Audit?

No API key is involved. GitHub Actions Security Audit answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.

How fast is GitHub Actions Security Audit?

It answers our handshake in 532 ms on average, which is faster than 23% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is GitHub Actions Security Audit open source?

Yes — it is published under the MIT licence, written in JavaScript and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.