MCP Trust Scan

July 9, 2026

Version updated for https://github.com/SteveMonsway/mcp-trust to version v1.

This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

One-line MCP-server preflight scan in CI — the root composite Action.

```yaml

uses: actions/checkout@v4
uses: SteveMonsway/mcp-trust@v1 with: { fail-on: high, upload-sarif: true, comment-pr: true } ```

Runs the published @mcp-trust/cli via `npx` (self-contained, no build). Uploads SARIF to Code Scanning, posts a PR comment, and fails the job above a severity threshold.

Inputs: `target`, `fail-on`, `output`, `output-dir`, `upload-sarif`, `comment-pr`, `no-semgrep`. Outputs: `decision`, `risk`, `score`, `sarif-file`, `exceeded`.

Live demo: SteveMonsway/mcp-trust-demo.

SteveMonsway
GitHub Actions