zanadir MCP server

zanadir reads a repository's CI configuration and reports which security and quality controls are missing, or wired so they cannot fail a build.

What it answers

scanning and secrets detection to SBOMs and workflow hardening, each checked against the tools that cover it, with suggestions that fit the repository's languages.

• What is my pipeline missing? Twelve categories, from dependency

continue-on-error, --exit-code 0, || true, a push-only trigger or allowfailure is present but cannot stop a merge. zanadir grades each control enforcing, partial, advisory or unknown* rather than just covered; see Effectiveness.

• Does my CI actually block on security findings? A scanner with

only counts as enforcing when branch protection or a ruleset requires it.

• Is that check required to merge? With --required-checks, a control

the gaps, or writes a workflow with --write.

• What do I add? zanadir fix prints ready-to-paste CI configuration for

It reads GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Azure Pipelines and Jenkins, from a checkout (--dir) or straight from GitHub (--repo), and reports as a table, JSON, SARIF or Markdown.

How common are these gaps? The State of CI security 2026 scanned 1,000 of the most-starred GitHub repositories: 511 declare no dependency, secret or code scanning at all, and 1 in 6 of those that run a scanner in CI have one that cannot fail the build.

zanadir scan --dir .
zanadir scan --repo github.com/owner/name --output json
zanadir fix --dir .

Installation

Try it on any public repository without installing anything:

docker run --rm mustachecase/zanadir scan --repo github.com/owner/name

To install it, download the archive for Linux, macOS or Windows (amd64 or arm64) from the latest release. checksums.txt lists each archive's SHA-256, and every archive has a build provenance attestation:

gh attestation verify zanadir_<version>_linux_amd64.tar.gz --repo MustacheCase/zanadir

Or with Homebrew (the tap is this repository) or Go:

brew tap --custom-remote MustacheCase/zanadir https://github.com/MustacheCase/zanadir.git
brew install mustachecase/zanadir/zanadir
go install github.com/MustacheCase/zanadir@latest

In GitHub Actions, use zanadir-action. This workflow reports on every pull request without failing it:

# .github/workflows/zanadir.yml
name: zanadir
on: [pull_request]
permissions:
  contents: read
jobs:
  zanadir:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: mustachecase/zanadir-action@v1.26
        with:
          dir: .

When you are ready to gate, add enforce: true (fail on any uncovered category), fail-on (only the categories you name) or fail-on-weakened. To post the report as a pull request comment, see Posting the report to a pull request.

zanadir and OpenSSF Scorecard

OpenSSF Scorecard and zanadir answer different questions, and work well together.

Shortened. The full README is on GitHub.