Ci Sentinel

Name: Ci Sentinel
Author: Baneado98

作者：Baneado98版本 0.1.0i★ –i在云端运行

注册名称io.github.Baneado98/ci-sentinel

安装

概览

作者提供的说明（英文原文）

Multi-CI security scanner with a live threat-intel feed of compromised CI components

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i非常新★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在云端运行
传输方式: Streamable HTTP
分类: 网络安全

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在作者的服务器上运行：你向它提出的内容会经过他们的服务器。
注册中心没有列出需要填写的密钥。

你需要

在云端运行无需安装任何东西，通过互联网连接

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

适用于网页版、桌面版和手机版 Claude：

打开 Settings → Connectors
点击 Add custom connector
粘贴下面的地址，然后点击 Add
如果要求登录，请登录作者的服务

https://ci-sentinel.vercel.app/mcp

在终端中运行这条命令

claude mcp add --transport http ci-sentinel https://ci-sentinel.vercel.app/mcp

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "ci-sentinel": {
      "url": "https://ci-sentinel.vercel.app/mcp"
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "ci-sentinel": {
      "type": "http",
      "url": "https://ci-sentinel.vercel.app/mcp"
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

ChatGPT 只能连接互联网上的服务器：

打开网页版 ChatGPT → Settings → Connectors (Apps)
点击 Create 或 Add（部分套餐需要先在 Advanced 中开启 Developer mode）
粘贴下面的地址，起个名字，然后保存
如果要求登录，请登录作者的服务

https://ci-sentinel.vercel.app/mcp

菜单名称可能因套餐和版本不同而略有差异。

你的选择通过 Cookie 保存在这台设备上，无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

我们还没有读取这个服务器的工具列表；我们会轮流检查各个端点。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月9日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 Baneado98 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
… 尚未检查
端点有响应
尚未检查；我们会轮流检查各个端点
… 尚未检查
使用 OAuth 登录
尚未检查；我们会轮流检查各个端点
… 尚未检查
工具描述中没有隐藏指令
尚未检查；我们会在检查端点时读取工具列表

与“网络安全”中的其他服务器比较i

星标数多于此分类中其他 1006 个服务器的 0%
发布到注册中心的时间比此分类中其他 1006 个服务器的 23% 更新
基础检查结果等于或优于此分类中其他 1006 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

Ci Sentinel 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在作者的云端运行。通过互联网连接，无需安装，但你发送的内容会经过作者的服务器。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.1.0）于5个月前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接，所以接受远程 MCP 服务器的应用也可以使用，例如开启开发者模式的 ChatGPT。

有什么可以替代它？

同一分类中有：GrindFree Agent Security, Zeqqat, Pre-transaction Safety Checks (Tanod)

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

GrindFree Agent Security

Pay-per-call agent security: prompt injection, URLs, tools, shell/SQL, memory, leaks, docs (x402)

作者：ronin93非常新今天更新

在你的电脑上运行

安装

Zeqqat

The safe MCP for Dokploy: agents deploy and fix apps without holding keys or seeing secrets.

作者：zeqqat非常新今天更新

在云端运行

安装

Pre-transaction Safety Checks (Tanod)

Safety checks before you sign, pay or install: contract, token and package scans, phishing, OFAC.

作者：tanod-labs起步阶段今天更新

在云端运行✓ tanod.dev

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

ci-sentinel 🛡️

Security auditor for SEVEN CI ecosystems — GitHub Actions, GitLab CI/CD, Jenkins, CircleCI, Azure Pipelines, Bitbucket Pipelines and Travis CI — finds the supply-chain and injection flaws a YAML linter can't see, *before* an attacker's pull/merge request runs code with your repository secrets.

Available as an MCP server (for Claude / Cursor / any agent) and a pay-per-call HTTP API (x402 USDC or a prepaid card key).

Give it your .github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile, .circleci/config.yml, azure-pipelines.yml, bitbucket-pipelines.yml and/or .travis.yml (each file is auto-routed to the right analyzer) and get a CRITICAL / VULNERABLE / RISKY / HARDENED verdict with the exact flaws.

What it catches that a linter can't

Class	What ci-sentinel does
💉 Expression injection (inter-step / inter-job taint)	Taints untrusted `${{ github.event.* }}` (issue/PR title, body, comment, review, branch name, commit message, label name, fork repo identity, edited-from values) to a `run:` shell or `actions/github-script` sink — and *follows it across `steps. .outputs.`, `needs. .outputs.`, `env:` vars, `matrix` values and reusable-workflow `inputs.`**. An attacker who hides the untrusted value behind an intermediate output is still caught; a per-file grep is not.
🎭 Pwn requests	`pull_request_target` / `workflow_run` that check out untrusted fork code in the privileged, secret-bearing context = arbitrary code execution with your secrets.
🔑 Token permissions	Excessive `GITHUB_TOKEN` scopes (`write-all`, `contents:write`, `id-token:write`), missing `permissions:` blocks, and secrets exposed to untrusted triggers.
🔁 Reusable workflows	`workflow_call` callers passing untrusted data across the boundary as `inputs.`, and `secrets: inherit`* handing the full secret set to a reusable workflow on an untrusted trigger.
📌 Action pinning	Third-party actions (and reusable-workflow `uses:`) on mutable tags/branches instead of a commit SHA (the `tj-actions/changed-files`-style hijack), resolved through the transitive action graph.
🖥️ Self-hosted RCE	Self-hosted runners reachable from public-repo PRs (RCE on your own infra), and OIDC `id-token` trust misuse.

…and the same depth for GitLab CI/CD (`.gitlab-ci.yml`)

Class	What ci-sentinel does
💉 CI-variable injection	Taints untrusted GitLab variables (`CI_COMMIT_REF_NAME/BRANCH/TAG`, `CI_MERGE_REQUEST_TITLE/DESCRIPTION/SOURCE_BRANCH_NAME`, commit message/author, triggering-user fields) interpolated into `script:` — following the taint through `variables:` and `extends:` templates. Knows the SAFE vars (`CI_COMMIT_SHA`, `CI_MERGE_REQUEST_IID`, `CI_PROJECT_ID`, …) so it doesn't flag every `$CI_`.
🎭 Fork merge-request pwn	Jobs reachable from fork MR pipelines (`merge_request_event`, `only: merge_requests`) that carry secrets / a broad `CI_JOB_TOKEN` / `id_tokens` (OIDC), or that run privileged work (deploy/publish/`kubectl`/`terraform`) with no `when: manual` gate.
📦 `include:` supply-chain	`include:` from a remote URL or another project/component on a moving (non-SHA) ref — foreign pipeline code merged into yours.
☣️ Artifact / cache poisoning	An untrusted job writes an artifact/cache that a privileged downstream job consumes and executes (`needs:`/`dependencies:` or a shared cache path) — a cross-job and cross-pipeline escalation.

…and five more CI systems, same taint model

Ecosystem	What ci-sentinel catches
🔧 Jenkins (`Jenkinsfile`)	Command injection from `params.` / `env.CHANGE_` / `ghprb*` / SCM data into `sh`/`bat`/`powershell` (through `environment{}` bindings); credential-leak (`credentials()`/`withCredentials` printed or baked into a GString); Groovy `evaluate()`/`load` RCE; missing `input()` approval gate; unsafe `agent any`.
⭕ CircleCI (`.circleci/config.yml`)	Shell injection from `<< pipeline.git.branch/tag >>` / pipeline parameters into `run:`; unpinned orbs (`@volatile` / bare major); fork-PR context secret exposure with no `type: approval` gate; privileged deploy with no approval.
🟦 Azure Pipelines (`azure-pipelines.yml`)	Macro injection from `$(Build.SourceBranch)` / `$(System.PullRequest.SourceBranch)` / commit message into `script:`/`bash:`/`pwsh:`; untrusted templates from a foreign repo resource; fork variable-group secret exposure; unpinned repository resources.
🪣 Bitbucket Pipelines (`bitbucket-pipelines.yml`)	Shell injection from `$BITBUCKET_BRANCH` / `$BITBUCKET_TAG` / `$BITBUCKET_PR_DESTINATION_BRANCH` / commit message expanded unquoted into `script:`; secured/deployment-variable exposure on externally-triggerable PR pipelines; unpinned pipes (`:latest`); deployments with no `trigger: manual` gate.
🚦 Travis CI (`.travis.yml`)	Shell injection from `$TRAVIS_BRANCH` / `$TRAVIS_PULL_REQUEST_BRANCH` / `$TRAVIS_COMMIT_MESSAGE` expanded unquoted into a lifecycle hook; secure-env PR/fork secret exposure; `deploy:` stages with no `on:` branch/condition gate.

…plus two deep cross-domain detectors a one-shot agent can't replicate

Detector What ci-sentinel catches

☁️ OIDC cloud-trust misconfiguration (Terraform / CloudFormation / GCP workload-identity / Azure federated-credential) Models the cloud half of CI OIDC: the trust policy of the IAM role / WIF pool / federated app. Flags a sub condition with a broad wildcard (repo:org/*, repo:*), no `sub` condition at all (any workflow on the issuer assumes the role), a repo pinned but ref/environment unpinned (any branch assumes), the bare pull_request subject (fork-reachable), or an unpinned aud. Then correlates the IaC trust with the CI side (a workflow that mints id-token reachable from an untrusted trigger) and escalates to critical when the chain is reachable end-to-end. No single-file linter catches this — it spans the CI claim and the cloud trust policy.

🔧 Jenkins shared libraries (@Library → vars/*.groovy) Taints an untrusted pipeline value (PR title / branch / build parameter) passed to a shared-library global-var step through the library's `call()` interior to an internal sh/bat sink — the Jenkins parity of orb/template/composite-action cross-file taint, invisible when reading only the `Jenkinsfile`. Also flags @Library imports on a mutable ref (a branch / default version) as supply-chain risk.

Each analyzer knows the SAFE variables (SHAs, numeric ids, trusted slugs — BITBUCKET_COMMIT, TRAVIS_PULL_REQUEST, pipeline.git.revision, …) and the SAFE OIDC trusts (sub pinned to repo:org/repo:ref:refs/heads/main / :environment:prod with aud set) so it doesn't flag every $VAR or every trust. Zero false positives on hardened configs.

It is a real static analyzer: a line-aware workflow YAML parser → a model of triggers/jobs/steps/permissions/actions/outputs/needs → an inter-step/inter-job taint resolver + permission + supply-chain detectors → a scored verdict with per-finding file:line, the full taint path, concrete remediation, and a SARIF 2.1.0 report (with codeFlows) you can upload to GitHub code scanning.

…and it doesn't just flag — it FIXES, and it GRADES

Premium	What you get
🔧 Auto-remediation (the exact fix)	For each finding ci-sentinel produces the concrete change: the corrected YAML/Groovy snippet and a unified diff you can apply — pin the action/orb/pipe to an immutable SHA/version, env-bind + quote the injected expression, drop write-all to least privilege, insert the manual/approval gate, pin the OIDC `sub`/`aud`, move the hardcoded secret to the store (and rotate it). Not "you have a bug" but "change THIS to THIS", with a confidence label (`exact` / `template` / `guided`) so you know what's drop-in vs. what needs a value filled. Findings carry a stable `fingerprint` for de-duplication, and the SARIF results carry inline `fixes`.
📋 Compliance scorecard (A–F)	A CIS-like CI security benchmark scored A–F with a PASS / FAIL / WARN / N/A breakdown per control (least privilege, component pinning, no secrets to forks, no self-hosted on public PRs, OIDC pinned, no hardcoded secrets, no pwn checkout, gated deploys, no injection, no cross-job poisoning). Each control lists the finding ids that drove its verdict — defensible to a security team. A directly-exploitable critical flaw caps the grade (one open RCE/secret-exfil path dominates the posture).
🛰️ Live threat-intelligence feed (the data moat)	Every `uses:` / orb / pipe in your config is checked against a live, server-side feed of KNOWN-compromised CI components, ingested on a cron from public sources — [OSV.dev](https://osv.dev) and the [GitHub Security Advisory](https://github.com/advisories) database (`ecosystem=actions`) — and merged onto a curated seed of the flagship incidents (`tj-actions/changed-files` CVE-2025-30066, `reviewdog/action-setup` CVE-2025-30154 and its transitive dependents, the `aquasecurity/trivy-action` tag force-push, Ultralytics). It knows that `tj-actions/changed-files@v45` is poison and that the same action SHA-pinned to a clean commit or upgraded to `@v46` is safe — a distinction a static YAML scan or a local linter cannot make, because it has no feed. The feed lives only on the hosted server (the thin client never carries it); `GET /feed/status` surfaces its freshness. A live reputation signal (stars / last-commit / archived / does-the-repo-still-resolve) additionally flags archived/abandoned components and dangling references that are takeover-bait. This is the access-moat that justifies the hosted, paid model: the value is the live DATA, not the compute.
🪤 Tag-rewrite & imposter detection (live ref→commit)	Give ci-sentinel the commit SHA you expected a mutable ref to be (from your lockfile/SBOM) and it resolves what the tag currently points at upstream — flagging a tag-rewrite / force-push (`@v2` now runs a different commit than you reviewed — the exact tj-actions attack), a deleted/dangling ref, or a suspiciously recent move. It also pairs typosquat detection with the live reputation signal to confirm impersonation — `actons/checkout` (a near-miss of `actions`) whose repo is a freshly-stood-up, low-star or dangling imposter — vs. a legitimately-named small fork (no false positive). And because the feed is keyed by component identity, a compromised action is caught no matter which CI system references it (cross-CI) — the piece a mono-CI scanner structurally can't have.

MCP server (free)

"mcpServers": { "ci-sentinel": { "command": "npx", "args": ["-y", "ci-sentinel-mcp"] } } }

Tool: `audit_ci_security`. Pass files (a map of workflow filename → YAML) or source (one workflow). The free tier returns the verdict and how many issues of each kind were found.

Deep audit (`deep: true`) — two ways to pay

The deep audit returns every finding with file:line, the full inter-step/ inter-job injection taint path, the transitive action supply-chain graph, a concrete fix (corrected snippet + unified diff) per finding, an A–F compliance scorecard with a per-control breakdown, and a SARIF 2.1.0 document with inline `fixes` (uploadable to GitHub code scanning via github/codeql-action/upload-sarif).

💳 Card (Stripe) — buy a prepaid key at https://ci-sentinel.vercel.app/pro/checkout, then set "env": { "CI_SENTINEL_KEY": " " } in your MCP config.
🪙 x402 (USDC) — AI agents pay per call automatically (USDC on Base), no signup.

HTTP API

POST /audit

只显示了开头部分；其余内容请在仓库中阅读