GitHub Action for MCP Audit

Automatically scan your MCP server on every push or pull request. Fail builds that don't meet your security threshold.

Quick Start

Create .github/workflows/mcp-audit.yml in your repository:

name: MCP Security Audit
on:
  push:
    branches: [main]
  pull_request:

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Run mcp-audit scan
        id: audit
        run: |
          RESULT=$(curl -sf -X POST https://audit.pyfio.com/api/v1/scan \
            -H "X-API-Key: ${{ secrets.MCP_AUDIT_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"repo": "${{ github.repository }}"}')

          SCORE=$(echo "$RESULT" | jq '.overallScore')
          SUMMARY=$(echo "$RESULT" | jq -r '.summary')
          CRITICALS=$(echo "$RESULT" | jq '[.findings[] | select(.severity=="critical")] | length')

          echo "score=$SCORE" >> $GITHUB_OUTPUT
          echo "## MCP Security Audit" >> $GITHUB_STEP_SUMMARY
          echo "**Score:** $SCORE/100" >> $GITHUB_STEP_SUMMARY
          echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY

          if [ "$CRITICALS" -gt 0 ]; then
            echo "::error::$CRITICALS critical finding(s) detected"
            exit 1
          fi
          if [ "$SCORE" -lt 60 ]; then
            echo "::error::Security score $SCORE is below threshold (60)"
            exit 1
          fi
          echo "Security score: $SCORE/100 - PASSED"

Features

Scans on every push and PR — catches issues before merge
Posts a summary to the GitHub Actions step summary
Fails the build on critical findings or low scores
Configurable score threshold (default: 60)
Works with the free tier (3 scans/day) or paid API keys

Setup

Get an API key (optional)

The free tier allows 3 scans/day without a key. For CI/CD, get a Pro plan for 100 scans/month.

Add the secret

Go to your repo Settings > Secrets > Actions, and add MCP_AUDIT_KEY with your API key.

Add the workflow file

Copy the YAML above into .github/workflows/mcp-audit.yml and push.

Badge for your README

Show your security score with an auto-updating badge:

[![mcp-audit](https://audit.pyfio.com/badge/OWNER/REPO)](https://audit.pyfio.com/report/OWNER/REPO)

Scan Your Server First