mcp-scan-action

The first GitHub Action that scans MCP servers, AI agents, and LLM pipelines for security vulnerabilities — and sends results directly to your GitHub Security tab.

24 vulnerability checks. 4 scan engines. Zero runtime cost. One line of YAML.

Why This Exists

MCP is moving fast. Thousands of servers are being built to give AI agents access to browsers, filesystems, APIs, and internal services. Almost none of them are being scanned for security vulnerabilities before they ship.

We scanned 5 popular open-source MCP servers. All 5 had findings:

A browser automation MCP with 33 registered tools exposes a playwright_evaluate tool that accepts raw JavaScript from the LLM — no validation, no sandboxing. That's remote code execution (CVSS 9.8) controlled by any prompt-injected agent. This action would have caught it before the first commit landed on main.

This action brings automated, continuous MCP security scanning to every team building on the Model Context Protocol — with zero configuration and no API key.

Quickstart — One Line

- uses: nhomyk/mcp-scan-action@v1

Add it to any job that checks out your code. That's it.

Full Workflow

name: MCP Security Scan

on: [push, pull_request]

jobs:
  mcp-security:
    name: MCP Security Scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write   # upload findings to GitHub Security tab
      contents: read

    steps:
      - uses: actions/checkout@v4

      - uses: nhomyk/mcp-scan-action@v1
        id: scan
        with:
          fail-on-critical: 'true'   # block merges on critical findings

      - name: Show risk level
        run: echo "Risk → ${{ steps.scan.outputs.risk-level }}"

Findings appear immediately under Security → Code scanning alerts.

What It Detects — 24 Vulnerability Classes

MCP Tool Poisoning (11 attack types)

Cross-Agent DataFlow Taint (9 finding types)

Tracks secrets and PII from source to sink across agent boundaries:

SECRET_SOURCE (line 87): authToken = randomBytes(32).toString('hex')
        │
        ▼ [UNSANITIZED]
SINK_LOGGING (line 89): console.log(`Generated auth token: ${authToken}`)
                                     ↑
                          DataFlow risk: 1.000  ← caught by this action

SECRET_SOURCE · PII_SOURCE · CROSS_BOUNDARY · SINK_LOGGING · SINK_NETWORK · SINK_STORAGE · TAINT_PROPAGATION · MISSING_SANITIZE · PRIVILEGE_ESCALATION

Prompt Injection (4 patterns)

Architecture Analysis (MCP/Agent integration points)

Static mapping of all MCP_TOOL, AGENT_FRAMEWORK, SHELL_EXEC, and EXTERNAL_HTTP integration areas — gives you a complete picture of your agent's attack surface before manual review.

Output — GitHub Security Tab

Findings upload as SARIF 2.1.0 directly to your repository's Security → Code scanning page. No third-party dashboard, no account required, no data leaves GitHub.

┌─────────────────────────────────────────────────────────────────┐
│  Security  /  Code scanning alerts                               │
│                                                                  │
│  ● SSRF_RISK          High     src/tools/requests.ts:99         │
│  ● AMBIENT_AUTHORITY  High     scripts/eval_gemini.ts:115       │
│  ● SINK_LOGGING       High     scripts/start-server.ts:89       │
│  ● SHADOW_TOOL        Medium   src/registry.ts:44               │
│                                                                  │
│  4 open alerts  ·  Powered by AgenticQA MCP Scanner             │
└─────────────────────────────────────────────────────────────────┘

Each alert includes: file path, line number, severity, CWE class, and remediation guidance.

Step Summary

After every run, a formatted summary appears in your workflow's Summary tab:

🔴 MCP Security Scan — CRITICAL

Total findings: 7 | Critical: 2

| Scanner                | Findings | Critical | Types Detected                          |
|------------------------|----------|----------|-----------------------------------------|
| MCP Tool Scan          | 3        | 1        | SSRF_RISK, COMMAND_INJECTION, SHADOW_TOOL |
| DataFlow Taint         | 2        | 1        | SECRET_SOURCE, SINK_LOGGING             |
| Prompt Injection       | 1        | 0        |                                         |
| Architecture (MCP/Agent)| 1       | 0        | AGENT_FRAMEWORK                         |

Use Outputs in Downstream Steps

- uses: nhomyk/mcp-scan-action@v1
  id: mcp

# Gate deployment on risk level
- name: Block on critical
  if: steps.mcp.outputs.risk-level == 'critical'
  run: |
    echo "❌ ${{ steps.mcp.outputs.critical-count }} critical finding(s) — deploy blocked"
    exit 1

# Save SARIF as workflow artifact
- name: Upload scan artifact
  uses: actions/upload-artifact@v4
  with:
    name: mcp-scan-sarif
    path: ${{ steps.mcp.outputs.sarif-file }}

# Post finding count to Slack/webhook
- name: Notify
  run: |
    curl -X POST $SLACK_WEBHOOK \
      -d "{\"text\": \"MCP scan: ${{ steps.mcp.outputs.findings-count }} findings, risk=${{ steps.mcp.outputs.risk-level }}\"}"

Inputs

Outputs

PR-Only Scan

on:
  pull_request:
    branches: [main]

jobs:
  mcp-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: nhomyk/mcp-scan-action@v1
        with:
          fail-on-critical: 'true'
          category: 'mcp-pr-scan'

Cost Savings

Static analysis catches an entire class of bugs — SSRF, command injection, credential logging — that are trivial to prevent and catastrophic to miss. Automating the check costs zero.

No API Key Required

All scanning is pure static analysis. The action:

• Never calls an LLM
• Never sends your code to an external service
• Produces results deterministically — same code, same findings, every run
• Works entirely within your GitHub Actions runner

Languages and Frameworks Supported

Detects MCP and agent patterns in:

How It Works

Your repo
    │
    ├── MCPSecurityScanner     → 11 attack types via pattern matching + tool schema analysis
    │                            Learned patterns accumulate from real findings
    │
    ├── CrossAgentDataFlowTracer → 9 taint finding types
    │                              Tracks SECRET/PII from source → sink across agent calls
    │
    ├── PromptInjectionScanner → 4 injection patterns
    │                            Direct concat · Template · Unsafe output · Role override
    │
    └── ArchitectureScanner    → Maps all MCP_TOOL + AGENT_FRAMEWORK integration points
                                 Full attack surface visibility before manual review
                                        │
                                        ▼
                               SARIFExporter (2.1.0)
                                        │
                                        ▼
                        GitHub Security → Code scanning alerts

Powered by AgenticQA

This action wraps the security scanners from AgenticQA — an open-source autonomous CI/CD platform for AI-native teams.

AgenticQA adds to your pipeline:

• Continuous MCP security scanning (this action)
• EU AI Act compliance — Annex III classification + Articles 9, 13, 14, 22
• HIPAA PHI detection — 5 PHI taint categories across your codebase
• Self-healing CI — SRE agent auto-fixes lint errors and test failures
• Adversarial hardening — Red Team agent with 20 bypass techniques + constitutional gate
• SOC 2 / GDPR — 7 compliance scanners, SARIF-exportable evidence

Explore AgenticQA →

License

MIT © nhomyk