GitHub Actions Audit
Let your agent scan GitHub Actions workflows for pinning, permissions, secrets exposure, and injection risks before you merge CI changes.
Overview
io.github.UnbearableDev/github-actions-audit is a MCP server for the Ship phase that audits GitHub Actions workflows with twenty-one checks for pinning, permissions, secrets, and injection.
What is this MCP server?
- 21 security checks: action pinning, permissions, secrets handling, and injection patterns
- Streamable-http MCP remote on Apify with secret Bearer token configuration
- Purpose-built for reviewing .github/workflows without third-party SaaS dashboards
- Complements manual code review when you iterate workflows from the agent
- GitHub-hosted source at UnbearableDev/github-actions-audit
- 21 GitHub Actions workflow security checks per server description
- Version 1.0.0 hosted at unbearable-dev--github-actions-audit Apify actor
What problem does it solve?
Your GitHub Actions workflows grew organically and you are unsure whether unpinned actions, loose permissions, or script injection gaps are exposing the repo.
Who is it for?
Solo maintainers who edit workflows in the agent and want a structured security pass without standing up a separate GHA analysis tool.
Skip if: Organizations that already run enterprise policy engines on every workflow change and treat MCP audits as redundant.
What do I get? / Deliverables
Connecting the server lets your agent flag workflow security issues with explicit check coverage so you can harden YAML before merge.
- Security audit output across twenty-one GitHub Actions check categories
- Pinning, permissions, secrets, and injection findings tied to workflow lines
- Remediation guidance your agent can apply directly in repository files
Recommended MCP Servers
Journey fit
How it compares
Workflow security audit MCP, not a general GitHub API integration or deployment orchestrator.
Common Questions / FAQ
Who is io.github.UnbearableDev/github-actions-audit for?
It is for developers who ship with GitHub Actions and want agent-assisted workflow security reviews backed by twenty-one targeted checks.
When should I use io.github.UnbearableDev/github-actions-audit?
Use it after adding third-party actions, changing permissions blocks, or embedding user input in run steps, ideally before merging to main.
How do I add io.github.UnbearableDev/github-actions-audit to my agent?
Configure the Apify MCP remote URL with a Bearer Apify token in your agent MCP settings, then invoke the audit tools against workflow file content.