Version updated for https://github.com/polygraphso/litmus to version litmus-v0.35.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary This GitHub Action, litmus, is designed to automate the process of evaluating and grading MCP servers based on their behavior. It connects to an MCP endpoint, runs a set of probes to evaluate the server’s performance, and provides a grade along with evidence files. The action can be used for both lookup and execution purposes, allowing users to quickly assess server capabilities and reproduce grades.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.34.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary This GitHub Action automates the evaluation of MCP servers to provide a reproducible grade A-F, ensuring compliance and consistency across different environments. It allows users to quickly check, list, or request grades for servers, verify attestation proofs, and run litmus tests directly from an agent server. The action supports various inputs including npm packages, pypi packages, GitHub repository clones, MCP endpoints, and local entry files, and ensures that the target’s code is executed within Docker sandboxing.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.33.1. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Patch release fixing two false positives in the litmus-v16 scanners, both found by a local regrade of the published set (#115). raven-mcp (was A→F): C-01 tool-poisoning. The exfil-instruction check tested the sink against the whole document, so a benign UI-docs surface that listed form fields ('Email', 'Password') and carried a URL elsewhere tripped it. The sink is now required in the same clause as the verb and object (one bounded, linear regex).

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.33.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Grading hardening: litmus-v16 (bundle schema 1.9.0). Coverage cap with sandbox exercise. The dynamic probes skip actively calling state-changing (write) tools on the host path so the harness can’t move money or mutate real state. Under Docker isolation the target runs with no network in a throwaway sandbox, so those tools are exercised by default and a write-capable server earns A on the same terms as a read-only one. The cap fires only where a call would hit a live backend (host path or a remote https target): one high-risk tool left unexercised caps at B, and an unexercised destructive tool together with an unverified category compounds to C.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.32.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Ships litmus-v15: the C-02 egress baseline now includes public package-registry infrastructure (pypi.org, files.pythonhosted.org, registry.npmjs.org), so a framework’s default startup update-check — chiefly FastMCP pinging pypi.org for a newer version — is no longer scored as the server’s egress overreach. The cloud instance-metadata endpoint stays flagged (a real credential-theft target).

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.31.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Adds three composable, backward-compatible launch knobs (#107) so the harness can grade honestly-built MCP servers that do not boot from a bare declared entry: serverArgs (--server-arg / server_args) — arguments appended to the server command, e.g. a mcp serve subcommand. Recorded in the evidence. serverEnv (--server-env KEY=VALUE / server_env) — startup env the server needs to boot, e.g. an API key. Injected privately like the planted canaries and redacted from the recorded command. entrySubpath (--entry / entry) — a package-relative entry file instead of a declared bin. Resolved inside the staged package root and rejected on traversal. Docker isolation only (npm/github). Setting serverArgs or entrySubpath bypasses bin probing and does a single named launch; the C-02 egress target launches the same way, so it grades the same process. All three are optional and default off (semver-minor).

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.30.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Ships litmus-v14: a C-04 probe 3.2 false-positive fix (#104). A server that safely rejects a jailbreak-as-argument and echoes it back inside its own error frame (Invalid label "…", Error: … not found: …), including char-stripped or truncated echoes, is no longer mis-flagged as amplification. Some safe-rejecting servers move D→A. server.json bumped in lockstep.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.29.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed litmus-v13 — C-01 tool-output-injection false-positive recalibration. Honest servers no longer flip to F on benign patterns that merely resemble injection. The C-01 static/output text scan now distinguishes real hijack attempts from ordinary documentation: angle-bracket placeholders in usage text (<tool>, <system|...>) data: / format examples (data:image/*;base64,…, XML/JSX samples) benign second-person prose in tool descriptions and returned docs U+200B zero-width doc artifacts — regraded MEDIUM, with keyword-evasion still caught HIGH via normalize-then-scan (ins<ZW>tructions de-obfuscates before the keyword pass) Skills keep every invisible character HIGH (S-01 strict). True-positive detection is preserved — the evil / injecting / second-order fixtures still grade F.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.26.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed The lookup tools now attribute the calling agent — and the release pipeline publishes the MCP-registry listing automatically. Client identity on lookups (#91): check_server, list_servers, and request_grade send the connected client’s handshake identity (name/version plus declared title, website, description, and capability keys such as sampling/roots) to polygraph.so’s aggregate per-agent usage counters. Software metadata only — nothing about the user is read or sent; all fields are optional server-side. Official MCP Registry auto-publish (#93): pushing a litmus-v* tag now also publishes server.json to registry.modelcontextprotocol.io via GitHub OIDC, with a fail-fast version-drift check. polygraph plugin 0.6.0: spawn pinned to this release (#92). No grading-semantics changes: litmus-v12 / litmus-skill-v2 unchanged.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.24.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Methodology litmus-v12 — two false-positive fixes so a server’s correct, defensive behavior is no longer graded as a fault. C-04 (probe 3.2): a validation error that quotes the rejected input back (e.g. Pydantic input_value='…') is a safe rejection, not server-generated amplification — no longer a false D. (#85) C-02 (probe 2.1): a mutation verb under a negation (“Cannot create or revoke keys”) no longer reads as a permission-mislabel lie; clause-scoped, so a real “Deletes… Cannot be undone.” still trips. (#85) methodologyVersion moves litmus-v11 → litmus-v12 (a string, so older attestations coexist). Release bump in #86. Both fixes are covered by regression tests reproduced from real servers.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.23.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed litmus-v11 — C-02 gains expected-upstream inference, fixing a first-party-egress false positive. An honest API-wrapper server — a tool that transparently calls the API it advertises (openai_chat → api.openai.com) — made an undeclared egress attempt and was capped at D, even though the upstream is the very API its own surface names. Before an undeclared host is now counted as overreach, the harness infers whether it is a plausible upstream for the server’s own tool surface: a host named verbatim in the tool text (strong), or an egress host whose registrable label matches a non-generic brand token drawn from the surface and the package owner/name (medium, plain-TLD hosts only). A match reclassifies the attempt from overreach into an informational egress-inferred finding — disclosure, not exoneration.

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.22.1. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Patch release shipping the security and correctness fixes from the 2026-07-02 engineering review. False-pass paths (grading correctness): A1 — iptables add-op is now atomic (set -e): a partial rule insertion exits non-zero so the caller falls back to --internal instead of running with broken NAT and silently missing IP-literal/DoH egress A2 — readOnlyHint:true can no longer bypass the exercise skip gate: unsafeToExerciseToolNames now checks the broad STATE_CHANGING_VERBS set regardless of the annotation, so a lying swap_*/buy_*/approve_*/mint_* tool is never actively bait-called A3 — content in a JSON-RPC error response is now scanned: callToolArgs carries errorText; probes 1.2, 1.3 run scanInjection on it, probe 3.1 runs internalsLeak A5 — MCP progress forwarding: void sendNotification(…) → .catch(() => {}) so a client disconnect during a run can’t kill the server process Sandbox observability:

Version updated for https://github.com/polygraphso/litmus to version litmus-v0.22.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Minor release shipping two changes from a false-positive review of the harness: #78 fix(c02) — the C-02 egress D rationale is now actionable: it names the undeclared host(s) and points authors at polygraph.egress, and the CLI itemizes them. Messaging only — every server’s letter grade is byte-identical. #79 feat(sandbox) — pypi/uvx MCP servers are now gradeable under the Docker sandbox. They stage wheels-only into a venv (no target code runs during staging; fails closed on sdist), resolve offline, and launch with the venv python. Both the connect and C-02 egress paths support pypi; gVisor runtime parity preserved. methodologyVersion is unchanged (litmus-v10) — a pypi server is graded by the same rubric as an npm one.