MCP.Market

GitHub Actions Audit MCP server

online · 100% uptime
by UnbearableDev·io.github.UnbearableDev/github-actions-audit·v1.0.1
No reviews yet

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.

B75/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed GitHub Actions Audit yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

GitHub Actions Audit tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 376ms (auth required)20/20
  • –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
  • Auth qualityauth enforced (unknown)9/15
  • Maintenancelast push 108 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How GitHub Actions Audit compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 40% of 1,119 Developer tools servers
Uptime
100%
of our recent checks; the typical remote Developer tools server answers 100%
Response time
220 ms
faster than 55% of 443 Developer tools servers

Install GitHub Actions Audit in Claude Code, Cursor or VS Code

claude mcp add --transport http github-actions-audit https://unbearable-dev--github-actions-audit.apify.actor/mcp
Add to Cursor

What the publisher says

From the GitHub Actions Audit repository's README, as published. We do not edit it. Read it on GitHub

GitHub Actions Security Audit

MCP server that audits .github/workflows/.yml files for supply-chain risks. Catches script injection, leaked tokens, unpinned actions, broad permissions, and pullrequest_target foot-guns — the patterns behind several 2024–2025 supply-chain incidents.

Built by Unbearable Labs. Pay-per-event — only billed when a tool is actually called.

Available on

  • Apify Actor Store — primary, metered usage (PPE)
  • MCPize — pending submission
  • MCP.so — pending submission
  • PulseMCP — pending submission
  • Smithery — pending submission
  • Glama — pending submission

Newsletter: Unbearable TechTips Weekly · All Actors: github.com/UnbearableDev

What it does

Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a workflow YAML, and get back structured findings with:

  • Severity — critical / high / medium / low / info
  • Affected job and step — exact location of the problem
  • Description — why it matters, with the actual attack vector
  • Remediation — what to do about it
  • Fix snippet — YAML you can paste directly

Tools

Provide exactly one of workflowyaml (paste the content) or workflowurl (HTTPS URL — typically a GitHub raw URL to a specific workflow file).

Check catalog (v2: 21 checks)

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

GitHub Actions Audit: common questions

Is GitHub Actions Audit MCP server safe?
Mostly: it is graded B (75/100). Read the GitHub Actions Audit safety report
How do I install GitHub Actions Audit?
It runs remotely at unbearable-dev--github-actions-audit.apify.actor. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does GitHub Actions Audit need an API key?
Yes. The registry entry asks for Authorization.
Is GitHub Actions Audit maintained?
The last commit was 144 days ago (2026-06-11). The latest release is v1.0.1.
Is GitHub Actions Audit up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
What can I use instead of GitHub Actions Audit?
Servers from other publishers that do the same job: cloud-audit MCP server, Grasp — Code Architecture & Dependency Analysis MCP server and zanadir MCP server.
How does GitHub Actions Audit compare with other Developer tools MCP servers?
safety score 75/100 (higher than 40% of 1,119 Developer tools servers); uptime 100% (of our recent checks; the typical remote Developer tools server answers 100%); response time 220 ms (faster than 55% of 443 Developer tools servers). Full comparison.

Alternatives to GitHub Actions Audit

Same job from other publishers: the closest match first, then the best rated.

  • cloud-audit
    AWS security scanner with attack chain detection, IAM privilege escalation, and fixes
    A
  • Grasp — Code Architecture & Dependency Analysis
    Codebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab.
    C
  • zanadir
    Find what a repository's CI is missing, and which security checks cannot fail the build.
    B
  • Gnt
    Git-native policy layer for AI agents: check_action verdicts against rules approved via PR.
    A
  • Pare Github
    Pare GitHub ג€” Structured GitHub operations (PRs, issues, actions) as typed JSON.
    More from Dave-London →
    A

More from UnbearableDev →