GitHub Actions Audit

Name: GitHub Actions Audit
Author: UnbearableDev

by UnbearableDevversion 1.0.1i★ –iRuns in the cloud

Registry nameio.github.UnbearableDev/github-actions-audit

Install

Overview

Description from the maker (original English)

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs in the cloud
Transport: Streamable HTTP
Category: Developer tools
You need to fill in: Authorization

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
You fill in yourself: Authorization

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Run this in your terminal

claude mcp add --transport http github-actions-audit https://unbearable-dev--github-actions-audit.apify.actor/mcp --header 'Authorization: your-value'

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "github-actions-audit": {
      "url": "https://unbearable-dev--github-actions-audit.apify.actor/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "github-actions-audit": {
      "type": "http",
      "url": "https://unbearable-dev--github-actions-audit.apify.actor/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

Authorization secret required HTTP header
Apify API token. Format: 'Bearer '. Get yours at https://console.apify.com/account/integrations

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account UnbearableDev, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Developer toolsi

More stars than 0% of the other 1394 servers in this category
Published to the registry more recently than 25% of the other 1394 servers in this category
Basic checks equal to or better than 100% of the other 1394 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is GitHub Actions Audit safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: Authorization

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.0.1) reached the registry 5 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: GitHub, Desktop Commander, Cloudflare MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

GitHub

by github

GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.

Computer or cloud★ 34,245MITUpdated 3 days ago

Install

Desktop Commander

by wonderwhy-er

MCP server for terminal commands, file operations, and process management

Runs on your computer★ 10,225MITUpdated 16 days ago

Install

Cloudflare MCP

by cloudflare

Cloudflare MCP servers

Runs in the cloud★ 4,446Apache-2.0Updated 14 months ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

GitHub Actions Security Audit

MCP server that audits .github/workflows/*.yml files for supply-chain risks. Catches script injection, leaked tokens, unpinned actions, broad permissions, and pull_request_target foot-guns — the patterns behind several 2024–2025 supply-chain incidents.

Built by [Unbearable Labs](https://github.com/UnbearableDev). Pay-per-event — only billed when a tool is actually called.

Available on

Apify Actor Store — primary, metered usage (PPE)
MCPize — *pending submission*
MCP.so — *pending submission*
PulseMCP — *pending submission*
Smithery — *pending submission*
Glama — *pending submission*

Newsletter: Unbearable TechTips Weekly · All Actors: github.com/UnbearableDev

What it does

Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a workflow YAML, and get back structured findings with:

Severity — critical / high / medium / low / info
Affected job and step — exact location of the problem
Description — why it matters, with the actual attack vector
Remediation — what to do about it
Fix snippet — YAML you can paste directly

Tools

Tool	Purpose
`audit_workflow(workflow_yaml? \	workflow_url?, min_severity='low')`	Run all checks
`check_secrets(...)`	Secret-leakage paths only
`check_permissions(...)`	`GITHUB_TOKEN` scope issues only
`check_action_pinning(...)`	Action version-pinning only
`check_runner_security(...)`	Self-hosted runner + script injection
`check_workflow_config(...)`	Timeout / config hygiene
`check_supply_chain_advanced(...)`	TeamPCP-class supply-chain patterns (GHA-201..208)
`list_checks(category?)`	Browse the catalog

Provide exactly one of workflow_yaml (paste the content) or workflow_url (HTTPS URL — typically a GitHub raw URL to a specific workflow file).

Check catalog (v2: 21 checks)

ID	Category	Severity	Title
GHA-001	secrets	high	Secret interpolated directly into `run:` script
GHA-002	secrets	high	Secret printed via echo / set-output
GHA-003	secrets	medium	Secret used in `if:` condition
GHA-004	secrets	high	Hardcoded credential pattern in `env:`
GHA-010	permissions	high	`permissions: write-all` granted
GHA-011	permissions	medium	No top-level `permissions:` (inherits broad default)
GHA-013	permissions	high	`pull_request_target` + checkout PR head = PWNing pattern
GHA-020	action_pinning	high	Third-party action pinned to mutable tag
GHA-021	action_pinning	high	Third-party action pinned to mutable branch
GHA-022	action_pinning	medium	First-party action not SHA-pinned
GHA-030	runner_security	medium	Self-hosted runner used on `pull_request` from forks
GHA-032	runner_security	high	Script injection via untrusted `github.event.*` interpolation
GHA-040	workflow_config	low	No `timeout-minutes` on job
GHA-201	supply_chain_advanced	high	Action pinned to unpinned branch ref (TeamPCP-class: @main/@master)
GHA-202	supply_chain_advanced	high	Action pinned to mutable tag — SHA pin recommended
GHA-203	supply_chain_advanced	critical	`pull_request_target` + checkout of PR head SHA/ref (codecov/tj-actions exploitation path)
GHA-204	supply_chain_advanced	high	Script injection via `github.event.*` user-controlled field in `run:`
GHA-205	supply_chain_advanced	medium	Action from non-allowlisted owner (untrusted 3rd-party)
GHA-206	supply_chain_advanced	high	Top-level `permissions: write-all` or `contents: write` without per-job scoping
GHA-207	supply_chain_advanced	medium	Secret logged via `echo` / `cat` in `run:` block
GHA-208	supply_chain_advanced	low	Action uses a known-retired tag

Pricing

Event	USD
Any audit / check_* tool call	$0.02
`list_checks` discovery	$0.005

Connecting from Claude Desktop

"mcpServers": { "gha-audit": { "transport": "streamable-http", "url": "https://YOUR-ACTOR-URL.apify.actor/mcp" } } }

Sibling MCPs from Unbearable Labs

[`docker-compose-audit`](https://apify.com/unbearable_dev/docker-compose-audit) — docker-compose.yml security audit
[`dockerfile-audit`](https://apify.com/unbearable_dev/dockerfile-audit) — Dockerfile security & quality
[`hu-postcode-validator`](https://apify.com/unbearable_dev/hu-postcode-validator) — Hungarian postcode lookup

What's NOT covered (yet)

Reusable workflow auditing (multi-file resolution)
CodeQL-grade dataflow tracking
Marketplace-listed action reputation scoring

Source / contact

Source: github.com/UnbearableDev/github-actions-audit. Issues + ideas: unbearabledev@gmail.com.

📬 Built by Noel @ Unbearable Labs. More MCP servers + audit tips in the newsletter: https://unbearabletechtips.beehiiv.com

GitHub Actions Audit

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Developer toolsi

Common questions

Alternatives

GitHub

Desktop Commander

Cloudflare MCP

README from the maker

GitHub Actions Security Audit

Available on

What it does

Tools

Check catalog (v2: 21 checks)

Pricing

Connecting from Claude Desktop

Sibling MCPs from Unbearable Labs

What's NOT covered (yet)

Source / contact