GitHub Actions Audit MCP Server

by unbearabledev Your server? Claim it

answering

GitHub Actions Audit is answering right now. Last checked 1 min ago. Last commit 11 Jun 2026.

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.

Uptime history 91 days of history

91 days agonow

100.0%

Uptime 24h

92 of 92 checks

—

Tools

hidden behind auth

387 ms

Response time

average over 24h

Stars

last commit 11 Jun 2026

Nothing serious here today

Today is the operative word: we check GitHub Actions Audit every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 1 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add github-actions-audit --transport http https://unbearable-dev--github-actions-audit.apify.actor/mcp

Settings → Connectors → Add custom connector, then paste this address

https://unbearable-dev--github-actions-audit.apify.actor/mcp

~/.codex/config.toml

[mcp_servers.github-actions-audit]
url = "https://unbearable-dev--github-actions-audit.apify.actor/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "github-actions-audit": {
      "url": "https://unbearable-dev--github-actions-audit.apify.actor/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "github-actions-audit": {
      "type": "http",
      "url": "https://unbearable-dev--github-actions-audit.apify.actor/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, but it did not say what kind of credentials it expects.

Endpoints

URL	Transport	State	Latency	Checked
https://unbearable-dev--github-actions-audit.apify.actor/mcp	streamable-http	needs auth	385 ms	1 min ago

Alternatives to GitHub Actions Audit

same job, measured the same way

Flowcheck

by cloudcorprecords

Least-privilege auditor for GitHub Actions workflows: permissions, triggers, secrets.

332 installs/wk local only

Taskbounty Check

by eliottreich

Local GitHub Actions/CI maintenance check (action pinning, token perms). Not a full security audit.

56 installs/wk local only

Gha Intel

by barissozudogru

Workflow timing analysis, configuration audit and billing insight for GitHub Actions.

47 installs/wk local only

GuardianShield

by sparkvibe-io

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

93 installs/wk local only

Actionpin

by cloudcorprecords

GitHub Actions supply-chain hardener: audit workflows for unpinned actions and build a SHA pin plan.

487 installs/wk local only

IAC Audit Pack

by unbearabledev

Four IaC audits in one call: Compose, Dockerfile, GitHub Actions, Kubernetes. 131 checks.

answering

GitHub

by aifity

Connect AI assistants to GitHub - manage repos, issues, PRs, workflows, and git operations.

local only

Sentrint

by sentrint

Code security scanner for founders and small teams: leaked secrets, missing RLS, injection, CVEs

answering

GitHub Actions Audit — questions

Answers built from our own checks of this server.

Why is there no tool list for GitHub Actions Audit?

The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.

Is GitHub Actions Audit working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 387 ms. The bar chart above shows every period we have measured.

How do I connect GitHub Actions Audit?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You will need your own credentials: it refuses anonymous clients.

Does GitHub Actions Audit need an API key?

Yes. Every time we knock, GitHub Actions Audit answers with an authorization challenge instead of its tool list — that is how we know it is running and gated rather than broken. Bring your own credentials and it will talk.

How fast is GitHub Actions Audit?

It answers our handshake in 387 ms on average, which is faster than 35% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is GitHub Actions Audit open source?

We cannot say either way: written in Python and 0 stars on GitHub, but we could not determine the licence, and without one the code is not open source by default.