GitHub Actions Audit
GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.
Servidor MCP · de UnbearableDev
Resumen
GitHub Actions Audit es un servidor MCP publicado por UnbearableDev. Marketplaces que leemos y que lo publican: 1 (Official MCP Registry). Lo vimos por primera vez el 2026-10-11 y desde entonces no hemos registrado cambios. Según nuestra pasada por los marketplaces del 2026-10-12.
Qué pide
- Se ejecuta en remoto
Ninguno de los marketplaces que leemos publica sus herramientas ni los ajustes que pide.
Lo que declara, pide y ejecuta, completo
Instale solo plugins de desarrolladores en los que confíe. Mostramos lo que publican los marketplaces y no probamos plugins.
Conectar
No hay datos para un comando automático: lo que declaran sus marketplaces no dice de forma inequívoca cómo conectarlo.
Dónde está publicado
| Marketplace | Estado | Versión | Cifras | Verificado | Visto por primera vez |
|---|---|---|---|---|---|
| Official MCP Registry (Abrir el registro) | Publicado | 1.0.1 | Forks (GitHub): 0 Estrellas (GitHub): 0 |
Sin marca |
Cada cifra es del propio marketplace y nunca se suma entre marketplaces. Un marketplace que no publica cifras no muestra ninguna: sin número no es cero.
Qué cambió
Nada ha cambiado en este plugin desde que lo seguimos.
Plugins similares
Productos cuyos propios nombres, descripciones, herramientas y skills son los más cercanos a este por su significado, en todos los marketplaces que leemos. La cercanía se ordena solo dentro de esta lista.
-
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
-
Diagnose GitHub Actions CI: lint, flaky tests, wasted minutes, health score. Read-only MCP tools.
-
regulatory-signals io.github.rikocr8orh8/regulatory-signals
Audit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.
-
Advanced Security plugin for GitHub Copilot.
-
Repo Security Scanner — Malicious Code & Supply Chain
Audit GitHub repos for malicious and supply-chain code before you depend on them.
-
Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.
-
Scan Git commits for security vulnerabilities using Almanax directly from Claude Code. The plugin connects to the Almanax MCP server to analyze commit diffs, surface findings by…
-
Agentic-Security is a powerful Claude Code plugin that automatically performs Application Security Testing (SAST, SCA, secrets detection, and more). Think of it as the easy button…
-
Analyze repos of any size - security scanning code analysis monorepo support
-
MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.
Plugins similares por marketplace
La misma pregunta a cada marketplace por separado: ¿hay allí un equivalente de este plugin?
Publicado en Claude Code: claude-plugins-community (5)
-
Scan Git commits for security vulnerabilities using Almanax directly from Claude Code. The plugin connects to the Almanax MCP server to analyze commit diffs, surface findings by…
-
Agentic-Security is a powerful Claude Code plugin that automatically performs Application Security Testing (SAST, SCA, secrets detection, and more). Think of it as the easy button…
-
Audits a codebase for secrets, PII, internal infrastructure references, and licensing issues before open-sourcing. Produces a remediation plan.
-
latio-secure-supply-chain-skills
Audit and take action to secure your repository against supply chain misconfigurations and malware.
-
GH-Guard hardens CI/CD pipelines for Rust projects. It generates production-tested GitHub Actions workflows with SHA-pinned actions, OIDC-based Trusted Publishing, SLSA L3…
Publicado en Claude Code: claude-plugins-official (5)
-
Set up endorctl and use Endor Labs to scan, prioritize, and fix security risks across your software supply chain
-
Aikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.
-
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
-
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF…
-
Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into…
Publicado en Claude: knowledge-work-plugins (5)
-
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF…
-
Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into…
-
Query the StackHawk platform API for security posture reporting, findings analysis, and app management. Guides agents through authentication, data retrieval, and result…
-
The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP server. It combines Vanta's test-specific remediation intelligence with…
-
Official Buildkite skills for Claude Code, Cursor, and other AI coding agents — pipelines, migration, preflight, agent runtime, CLI, and API
Publicado en Codex: openai-curated (openai/plugins) (5)
-
Inspect repositories, triage pull requests and issues, debug CI, and publish changes through a hybrid GitHub connector and CLI workflow.
-
Codex Security workflows for security scans, analysis, and investigation.
-
Inspect recent issues and events in Sentry from Codex.
-
AI-powered code review in Codex, powered by CodeRabbit.
-
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API…
Publicado en Community GitHub marketplaces (5)
-
Aikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.
-
Sourcery security findings for AI coding agents: triage and minimal-change remediation via the public Sourcery API (12 MCP tools + skills).
-
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including…
-
Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Agent and AWS Security Agent.
-
Dash0 Observability
OpenTelemetry observability for OpenAI Codex sessions. Captures prompts, tool calls, MCP calls, sub-agent activity, and token usage as OTel traces.
Publicado en Copilot CLI: github/awesome-copilot (5)
-
Browse repository GitHub Actions workflows, inspect recent runs, and trigger manual workflow_dispatch runs from a Copilot canvas.
-
Navigate pull requests and securely explore GitHub Actions artifacts, including test results, static sites, terminal recordings, and source files.
-
Triage Dependabot alerts and recommend safe, evidence-based dependency updates.
-
Analyze any repository and generate AI-ready configuration — AGENTS.md, copilot-instructions.md, CI workflows, issue templates, and more. Mines your PR review patterns and creates…
-
Inspect a repository, improve Tiny Tool Town readiness, submit its listing issue, and launch remediation work.
Publicado en Copilot CLI: github/copilot-plugins (5)
-
Advanced Security plugin for GitHub Copilot.
-
Bring Azure DevOps work-item, repository, and pull-request workflows into GitHub Copilot.
-
Toolkit for building Microsoft 365 Copilot declarative agents — scaffolding, JSON manifest development, and capability configuration.
-
code-apps-preview
Build and deploy Power Apps code apps using React, Vite, and Power Platform connectors.
-
Build Power Apps Canvas Apps using the Canvas Authoring MCP server.
Publicado en Cursor: cursor/plugins (5)
-
CLI-backed repo compatibility scans plus agents that audit startup, validation, and docs against reality.
-
Manage repos, issues, pull requests, and Actions.
-
Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that…
-
Internal team workflows for CI, code review, shipping, local automation, and verification.
-
Build apps, scripts, and automations with the TypeScript SDK.
Publicado en Docker MCP Catalog (5)
-
MCP server for using Semgrep to scan code for security vulnerabilities.
-
Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.
-
stackhawk com.stackhawk/stackhawk
An MCP server that provides interaction with StackHawk's security scanning platform.
-
Connects with the Beagle Security backend using a user token to manage applications, run automated security tests, track vulnerabilities across environments, and gain intelligence…
-
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
Publicado en Official MCP Registry (5)
-
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
-
Diagnose GitHub Actions CI: lint, flaky tests, wasted minutes, health score. Read-only MCP tools.
-
regulatory-signals io.github.rikocr8orh8/regulatory-signals
Audit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.
-
Repo Security Scanner — Malicious Code & Supply Chain
Audit GitHub repos for malicious and supply-chain code before you depend on them.
-
Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.
Encontrados por significado, no por código ni repositorio compartidos: los plugins similares siguen siendo productos distintos, y esto no es una reseña ni una recomendación.
¿Es tu plugin?
Demuestre que mantiene el plugin con un archivo en su repositorio, un archivo en su dominio o un registro DNS. Recibirá avisos cuando un marketplace lo publique, lo retire, cambie su marca de verificado o lo que pide, y podrá poner su endpoint remoto en monitorización como servicio web.
Datos de Official MCP Registry. Las cifras proceden de nuestros propios recorridos periódicos por los marketplaces, leída por última vez el . No publicamos datos de contacto de los editores de plugins.