Claude MarketplacesSubmit
unbearabledev avatar

GitHub Actions Audit

unbearabledev/github-actions-audit

This server audits GitHub Actions workflow YAML files for 21 supply chain vulnerabilities, from script injection and secret leaks to the pull_request_target exploitation pattern that bit codecov and tj-actions. You can paste workflow content directly or pass a raw GitHub URL, then get back structured findings with severity, exact step location, and fix snippets. Use audit_workflow() to run all checks or narrow to check_secrets(), check_permissions(), check_action_pinning(), and four others. It catches patterns like unpinned actions on mutable tags, GITHUB_TOKEN write-all grants, and untrusted github.event interpolation. Runs on Apify with pay-per-event billing at two cents per audit call. Built by Unbearable Labs alongside sibling auditors for Dockerfiles and docker-compose files.

tools
8
auth
Secret needed
transport
HTTP
last updated
Jun 10, 2026
View on GitHub

Tools

8 tools

Public tool metadata for what this MCP can expose to an agent.

audit_workflowRun all checks.

Run all checks.

No parameter schema in public metadata yet.

check_secretsSecret-leakage paths only.

Secret-leakage paths only.

No parameter schema in public metadata yet.

check_permissionsGITHUB_TOKEN scope issues only.

GITHUB_TOKEN scope issues only.

No parameter schema in public metadata yet.

check_action_pinningAction version-pinning only.

Action version-pinning only.

No parameter schema in public metadata yet.

check_runner_securitySelf-hosted runner + script injection.

Self-hosted runner + script injection.

No parameter schema in public metadata yet.

check_workflow_configTimeout / config hygiene.

Timeout / config hygiene.

No parameter schema in public metadata yet.

check_supply_chain_advancedTeamPCP-class supply-chain patterns (GHA-201..208).

TeamPCP-class supply-chain patterns (GHA-201..208).

No parameter schema in public metadata yet.

list_checksBrowse the catalog.

Browse the catalog.

No parameter schema in public metadata yet.

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Readme

GitHub Actions Security Audit

MCP server that audits .github/workflows/*.yml files for supply-chain risks. Catches script injection, leaked tokens, unpinned actions, broad permissions, and pull_request_target foot-guns — the patterns behind several 2024–2025 supply-chain incidents.

Built by Unbearable Labs. Pay-per-event — only billed when a tool is actually called.

Available on

  • Apify Actor Store — primary, metered usage (PPE)
  • MCPize — pending submission
  • MCP.so — pending submission
  • PulseMCP — pending submission
  • Smithery — pending submission
  • Glama — pending submission

Newsletter: Unbearable TechTips Weekly · All Actors: github.com/UnbearableDev

What it does

Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a workflow YAML, and get back structured findings with:

View the full README on GitHub

Details

Repository
github.com/unbearabledev/github-actions-audit
Categories
Developer Tools, Automation & Workflows, Security & Pentesting
Transport
HTTP
Auth
Required
Registry
MCP registry, active

More from unbearabledev

Related Developer Tools MCP servers

View all
1idosal avatarGitMCPidosal/git-mcpProvides up-to-date repository docs and code access via MCP with targeted, low-hallucination queries.8.1Kstars
2gitkraken avatarGk Cligitkraken/gk-cliThe GitKraken MCP Server for managing repos, PRs, issues across GitHub, GitLab, Bitbucket and more.462stars
3ashfordeou avatarGrasp — Code Architecture & Dependency Analysisashfordeou/graspCodebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab.31stars
4seuros avatarSkipperseuros/skipperGit and forge ops: local git via gitoxide, plus GitHub, GitLab, Gitea and Forgejo23stars
5muvon avatarOctofsmuvon/octofsStandalone MCP filesystem tools server — view, edit, shell, workdir.19stars
6traviswye avatarContextatlastraviswye/contextatlasPre-computed atlas of your codebase for Claude Code: LSP + ADRs + git. 45-72% token reduction.6stars