The first GitHub Action that scans MCP servers, AI agents & LLM pipelines for security vulnerabilities. 24 checks: tool poisoning, SSRF, prompt injection, DataFlow taint. Results in GitHub Security tab via SARIF. No API key required.
mcp-scan-action
The first GitHub Action that scans MCP servers, AI agents, and LLM pipelines for security vulnerabilities — and sends results directly to your GitHub Security tab.
24 vulnerability checks. 4 scan engines. Zero runtime cost. One line of YAML.
Why This Exists
MCP is moving fast. Thousands of servers are being built to give AI agents access to browsers, filesystems, APIs, and internal services. Almost none of them are being scanned for security vulnerabilities before they ship.
We scanned 5 popular open-source MCP servers. All 5 had findings:
| Repo Type | Risk Score | Top Finding | Severity |
|-----------|-----------|-------------|----------|
| Browser automation MCP | 1.000 (Critical) | Arbitrary JS execution via playwright_evaluate | CVSS 9.8 |
| Productivity API connector | 0.390 | Auth token logged to stdout | High |
| Browser vendor DevTools MCP | 0.080 | Full environment cloned to child process | High |
| Vector DB Claude plugin | 0.150 | Unpinned npx -y supply chain risk | Medium |
| Search MCP server | 0.200 | SSRF via unvalidated URL parameter | High |
A browser automation MCP with 33 registered tools exposes a
playwright_evaluatetool that accepts raw JavaScript from the LLM — no validation, no sandboxing. That's remote code execution (CVSS 9.8) controlled by any prompt-injected agent. This action would have caught it before the first commit landed onmain.
This action brings automated, continuous MCP security scanning to every team building on the Model Context Protocol — with zero configuration and no API key.
Quickstart — One Line
- uses: nhomyk/mcp-scan-action@v1
Add it to any job that checks out your code. That's it.
Full Workflow
name: MCP Security Scan
on: [push, pull_request]
jobs:
mcp-security:
name: MCP Security Scan
runs-on: ubuntu-latest
permissions:
security-events: write # upload findings to GitHub Security tab
contents: read
steps:
- uses: actions/checkout@v4
- uses: nhomyk/mcp-scan-action@v1
id: scan
with:
fail-on-critical: 'true' # block merges on critical findings
- name: Show risk level
run: echo "Risk → ${{ steps.scan.outputs.risk-level }}"
Findings appear immediately under Security → Code scanning alerts.
What It Detects — 24 Vulnerability Classes
MCP Tool Poisoning (11 attack types)
| Attack Type | What It Finds | Real-World Example |
|-------------|---------------|-------------------|
| TOOL_POISONING | Tool descriptions/schemas that manipulate LLM behavior | Hidden instructions in tool metadata |
| EXFILTRATION_PATTERN | Data routed to unexpected external endpoints | Credentials forwarded to attacker-controlled URL |
| PROMPT_INJECTION_VECTOR | User-controlled data concatenated unsafely into prompts | f"Summarize: {user_input}" without sanitization |
| AMBIENT_AUTHORITY | Tools with implicit permissions beyond declared scope | Object.entries(process.env) cloned to child process |
| UNRESTRICTED_FILE_ACCESS | Filesystem access without path sanitization | Path traversal via ../../../etc/passwd |
| SSRF_RISK | Server-side request forgery via tool-controlled URLs | args.url passed to fetch() without domain allowlist |
| COMMAND_INJECTION | Shell commands constructed from LLM/user input | exec("ls " + args.directory) |
| MISSING_AUTH | Authenticated actions reachable without credential checks | Tool handler missing token validation |
| UNCONSTRAINED_SCOPE | Agents with no permission boundaries | Agent with read+write+execute on arbitrary paths |
| CROSS_ORIGIN_ESCALATION | Cross-agent trust boundary violations | Agent A forwarding unvalidated output to Agent B |
| SHADOW_TOOL | Hidden tool registrations not visible to user | Tools registered without appearing in tool list |
Cross-Agent DataFlow Taint (9 finding types)
Tracks secrets and PII from source to sink across agent boundaries:
SECRET_SOURCE (line 87): authToken = randomBytes(32).toString('hex')
│
▼ [UNSANITIZED]
SINK_LOGGING (line 89): console.log(`Generated auth token: ${authToken}`)
↑
DataFlow risk: 1.000 ← caught by this action
SECRET_SOURCE · PII_SOURCE · CROSS_BOUNDARY · SINK_LOGGING · SINK_NETWORK · SINK_STORAGE · TAINT_PROPAGATION · MISSING_SANITIZE · PRIVILEGE_ESCALATION
Prompt Injection (4 patterns)
| Pattern | Example |
|---------|---------|
| Direct concatenation | prompt = "Answer: " + user_message |
| Template injection | f"You are helpful. {system_prompt}" with user-controlled system_prompt |
| Unsafe LLM output | LLM response passed to eval() or exec() without validation |
| Role override | User input that can override system role context |
Architecture Analysis (MCP/Agent integration points)
Static mapping of all MCP_TOOL, AGENT_FRAMEWORK, SHELL_EXEC, and EXTERNAL_HTTP integration areas — gives you a complete picture of your agent's attack surface before manual review.
Output — GitHub Security Tab
Findings upload as SARIF 2.1.0 directly to your repository's Security → Code scanning page. No third-party dashboard, no account required, no data leaves GitHub.
┌─────────────────────────────────────────────────────────────────┐
│ Security / Code scanning alerts │
│ │
│ ● SSRF_RISK High src/tools/requests.ts:99 │
│ ● AMBIENT_AUTHORITY High scripts/eval_gemini.ts:115 │
│ ● SINK_LOGGING High scripts/start-server.ts:89 │
│ ● SHADOW_TOOL Medium src/registry.ts:44 │
│ │
│ 4 open alerts · Powered by AgenticQA MCP Scanner │
└─────────────────────────────────────────────────────────────────┘
Each alert includes: file path, line number, severity, CWE class, and remediation guidance.
Step Summary
After every run, a formatted summary appears in your workflow's Summary tab:
🔴 MCP Security Scan — CRITICAL
Total findings: 7 | Critical: 2
| Scanner | Findings | Critical | Types Detected |
|------------------------|----------|----------|-----------------------------------------|
| MCP Tool Scan | 3 | 1 | SSRF_RISK, COMMAND_INJECTION, SHADOW_TOOL |
| DataFlow Taint | 2 | 1 | SECRET_SOURCE, SINK_LOGGING |
| Prompt Injection | 1 | 0 | |
| Architecture (MCP/Agent)| 1 | 0 | AGENT_FRAMEWORK |
Use Outputs in Downstream Steps
- uses: nhomyk/mcp-scan-action@v1
id: mcp
# Gate deployment on risk level
- name: Block on critical
if: steps.mcp.outputs.risk-level == 'critical'
run: |
echo "❌ ${{ steps.mcp.outputs.critical-count }} critical finding(s) — deploy blocked"
exit 1
# Save SARIF as workflow artifact
- name: Upload scan artifact
uses: actions/upload-artifact@v4
with:
name: mcp-scan-sarif
path: ${{ steps.mcp.outputs.sarif-file }}
# Post finding count to Slack/webhook
- name: Notify
run: |
curl -X POST $SLACK_WEBHOOK \
-d "{\"text\": \"MCP scan: ${{ steps.mcp.outputs.findings-count }} findings, risk=${{ steps.mcp.outputs.risk-level }}\"}"
Inputs
| Input | Default | Description |
|-------|---------|-------------|
| repo-path | . | Path to the repository root to scan |
| fail-on-critical | false | Exit code 1 if any critical findings exist |
| sarif-output | mcp-scan-results.sarif | SARIF output filename |
| upload-sarif | true | Upload to GitHub Code Scanning (security-events: write required) |
| category | mcp-security | SARIF category — useful when running multiple scan jobs |
Outputs
| Output | Values | Description |
|--------|--------|-------------|
| findings-count | integer | Total findings across all 4 scan engines |
| risk-level | low · medium · high · critical | Overall risk classification |
| critical-count | integer | Number of critical-severity findings |
| sarif-file | path | Location of the generated SARIF file |
PR-Only Scan
on:
pull_request:
branches: [main]
jobs:
mcp-scan:
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: nhomyk/mcp-scan-action@v1
with:
fail-on-critical: 'true'
category: 'mcp-pr-scan'
Cost Savings
| Without this action | With this action | |---------------------|-----------------| | Manual security review: ~40 hrs × $200/hr = $8,000 per review cycle | $0 — runs on every push | | Average cost of a data breach: $4.88M (IBM 2024) | Catch credential leaks before they reach production | | Security consultant for MCP audit: $15,000–$50,000 | Automated, continuous, deterministic | | Finding a bug in production: 6× more expensive than finding it in CI | Shift-left: block the merge, not the incident |
Static analysis catches an entire class of bugs — SSRF, command injection, credential logging — that are trivial to prevent and catastrophic to miss. Automating the check costs zero.
No API Key Required
All scanning is pure static analysis. The action:
- Never calls an LLM
- Never sends your code to an external service
- Produces results deterministically — same code, same findings, every run
- Works entirely within your GitHub Actions runner
Languages and Frameworks Supported
Detects MCP and agent patterns in:
| Language | Frameworks / Patterns |
|----------|-----------------------|
| TypeScript / JavaScript | @modelcontextprotocol/sdk, LangChain.js, AutoGen JS, direct fetch() calls |
| Python | langchain, langgraph, crewai, autogen, anthropic, openai SDK |
| JSON | mcp*.json config files — tool registrations, npx -y supply chain risk |
| Any | Architecture analysis runs on all supported languages |
How It Works
Your repo
│
├── MCPSecurityScanner → 11 attack types via pattern matching + tool schema analysis
│ Learned patterns accumulate from real findings
│
├── CrossAgentDataFlowTracer → 9 taint finding types
│ Tracks SECRET/PII from source → sink across agent calls
│
├── PromptInjectionScanner → 4 injection patterns
│ Direct concat · Template · Unsafe output · Role override
│
└── ArchitectureScanner → Maps all MCP_TOOL + AGENT_FRAMEWORK integration points
Full attack surface visibility before manual review
│
▼
SARIFExporter (2.1.0)
│
▼
GitHub Security → Code scanning alerts
Powered by AgenticQA
This action wraps the security scanners from AgenticQA — an open-source autonomous CI/CD platform for AI-native teams.
AgenticQA adds to your pipeline:
- Continuous MCP security scanning (this action)
- EU AI Act compliance — Annex III classification + Articles 9, 13, 14, 22
- HIPAA PHI detection — 5 PHI taint categories across your codebase
- Self-healing CI — SRE agent auto-fixes lint errors and test failures
- Adversarial hardening — Red Team agent with 20 bypass techniques + constitutional gate
- SOC 2 / GDPR — 7 compliance scanners, SARIF-exportable evidence
License
MIT © nhomyk