Skip to main content
Glama
workflowlint-mcp
by 0xmortuex

workflowlint-mcp

An MCP server that lets an AI audit GitHub Actions workflows: security and correctness findings with a rule ID, severity, file:line (exact even inside multi-line run: | blocks) and a concrete fix, plus a cron explainer with the next run times, a needs graph with critical path, a least-privilege permissions review, a commit-SHA pin plan and a diff of the safe automatic fixes. It is read-only, offline by default, and needs no external binary.

How it differs from what exists. The GitHub Actions MCP servers I could find either wrap actionlint (a Go binary you must install; it checks syntax and shell, not supply-chain risk) or are hosted scanners such as github-actions-audit and github-actions-audit-mcp, which report findings but do not explain schedules, draw job graphs, review token permissions, or produce patches. This server is pure Python (mcp + pyyaml), runs locally, and adds: a position-aware YAML model (so on: is not the boolean True, 3.10 is flagged, anchors resolve, and every finding has a real line), script-injection analysis that knows the dangerous github.event.* contexts, a built-in cron engine, a fix_preview that proves each patch by re-linting it, and an opt-in online SHA resolver that talks to api.github.com only.

Install

Claude Code:

claude mcp add workflowlint -- uvx workflowlint-mcp --dir .

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "workflowlint": {
      "command": "uvx",
      "args": ["workflowlint-mcp", "--dir", "C:\\path\\to\\your\\repo"]
    }
  }
}

Without uv: pip install workflowlint-mcp, then run workflowlint-mcp --dir /path/to/repo.

Flag

Meaning

--dir PATH

Only files inside this directory can be read (default: the current directory).

--disable IDS

Comma-separated rule ids to turn off, e.g. --disable GHA1013,GHA1021. Repeatable.

(There is also an undocumented --github-api-url flag that tests use to point the online pin lookup at a local fake server. It is a server flag, not a tool argument, so a model cannot use it.)

Silence one finding in the file itself with a comment on the line above it (or at the end of the line):

      # workflowlint-ignore: GHA1001, GHA1003
      - uses: some/action@v1

Related MCP server: github-actions-audit

Tools

Tool

What it does

workflows_overview(path)

Workflows, triggers, jobs, runners, needs, permissions per job, every action with its version and whether it is SHA-pinned, environments, and the names of referenced secrets. Covers composite actions too.

lint_workflows(path)

33 rules (GHA1001-GHA1033) with severity, file:line and a fix. See the table below.

explain_triggers(path)

When each workflow runs, in plain English. Cron expressions are explained with the next 5 run times in UTC from a built-in cron engine (including the day-of-month/day-of-week OR rule), plus notes on congestion, the 5-minute minimum, default-branch-only schedules and the 60-day inactivity shutdown.

permissions_review(path)

Effective GITHUB_TOKEN permissions per job (job-level replaces workflow-level), what each job appears to need (from known actions and gh/git commands), excess write access, missing permissions, and a least-privilege block to paste.

job_graph(path)

The needs graph as text and Mermaid, parallel waves, critical path, and a worst-case duration bound from timeout-minutes. Reports cycles.

pin_actions_plan(path, online=false)

Every uses: not pinned to a commit SHA, grouped, with how to pin it. With online=true, tags and branches are resolved to SHAs through api.github.com only.

fix_preview(path)

Unified diff of the safe fixes: read-only permissions: when every job is recognised as read-only, injectable expressions moved into step env:, ::set-output replaced with $GITHUB_OUTPUT. Re-linted to prove the findings vanish. Never writes.

path is a workflow file, a repository root containing .github/workflows, or the workflows directory, relative to --dir or absolute inside it. Local composite actions (.github/actions/**/action.yml) are included.

Try asking

  • "Audit my GitHub Actions workflows and fix everything that is safe."

  • "Is any workflow vulnerable to script injection or a pwn request?"

  • "Which actions are not pinned to a commit SHA? Look the SHAs up." (online=true; set GITHUB_TOKEN to avoid the 60 requests/hour limit)

  • "When does the nightly workflow run next? Why did it not run last week?"

  • "What permissions does each job really need? Give me a least-privilege permissions: block."

  • "Draw the job graph for the release workflow and tell me the critical path."

  • "Review my reusable workflow call: do the inputs and secrets match?"

Rules

ID

Severity

Rule

GHA1000

error

file is not valid YAML (reported with its line instead of failing)

GHA1001

error / warning / info

action is not pinned to a full commit SHA (third-party branch = error, third-party tag = warning, actions/* or github/* tag = info)

GHA1002

error

pull_request_target / workflow_run checks out and runs untrusted PR code (pwn request)

GHA1003

error

untrusted expression expanded inside run: or github-script (script injection)

GHA1004

warning

no permissions: key, so the token gets the repository default (often write)

GHA1005

error

permissions: write-all

GHA1006

warning

secrets: inherit hands every secret to the called workflow

GHA1007

warning / error

secret printed or interpolated into a command line

GHA1008

warning

downloads and executes a script in one step (curl | bash)

GHA1009

warning / info

checkout leaves the token in .git/config while later steps run other code

GHA1010

warning

self-hosted runner reachable from pull requests or other outsider events

GHA1011

warning / error

deprecated workflow command (set-output, save-state, set-env, add-path)

GHA1012

error

ACTIONS_ALLOW_UNSECURE_COMMANDS re-enables disabled commands

GHA1013

info

job has no timeout-minutes (default is 360)

GHA1014

info

deploy-like job without a concurrency group

GHA1015

error

needs: names a job that does not exist

GHA1016

error

needs: forms a cycle

GHA1017

error

if: condition that is always true (${{ x }} == y) or silently lost (if: !cancelled())

GHA1018

error

unknown context in an expression

GHA1019

warning

misspelled github.* / github.event.* property (partial table)

GHA1020

error

matrix is empty or larger than 256 jobs

GHA1021

info

runner label tracks latest

GHA1022

error

call does not match the reusable workflow's inputs/secrets (same repository)

GHA1023

error / warning

retired or deprecated action version (dated table)

GHA1024

error

upload-artifact and download-artifact majors are incompatible

GHA1025

warning

cache key has no content hash

GHA1026

warning / info

continue-on-error hides failures

GHA1027

error

structure problem: missing runs-on/steps/jobs, unknown keys, unknown events or permission scopes

GHA1028

warning

unquoted version number loses its trailing zero (python-version: 3.10)

GHA1029

error

invalid cron expression in schedule

GHA1030

info

schedule at minute 0 or more often than every 5 minutes

GHA1031

error

composite action run: step without shell:

GHA1032

info

job is granted write access it does not appear to use

GHA1033

error

duplicate mapping key

The injection contexts checked by GHA1003 are the documented attacker-writable fields: issue, pull request, discussion, comment and review titles and bodies; pull_request.head.ref/label/repo.*; commit messages and author/committer names and emails (head_commit, commits[*], workflow_run.head_commit); head_branch and display_title of a workflow run; release name/body/tag; client_payload.*; github.head_ref. Workflow inputs and github.ref_name are reported as warnings (the person who starts the run chooses them).

Security

  • Read-only. No tool writes a file or runs a command. fix_preview and pin_actions_plan return text.

  • Sandboxed. Every path is resolved (symlinks included) and must stay inside --dir. Files are capped at 1 MB and 20,000 lines and must be UTF-8.

  • YAML is parsed safely. Only PyYAML's composer is used (no object construction, no tags executed). Alias expansion is capped at 100,000 nodes and 20 MB of text, nesting at 60 levels, so alias bombs become a finding, not a hang.

  • Secrets: names only. Findings and overviews show secrets.NAME, never a value. As a last line of defence every output passes through a redactor that masks well-known token formats, ://user:pass@ URLs and password: literal lines, so a literal secret in a diff context line is not repeated to the model.

  • The network is off by default. pin_actions_plan(online=true) contacts exactly one host, api.github.com (validated owner/repo/ref characters, 10 s timeout, redirects only to the same host, at most 60 lookups per call, results cached). If GITHUB_TOKEN is set in the server's environment it is sent only as the Authorization header to that host and is never printed. Rate limits are reported honestly with the reset time.

Limits you should know about

  • It reads files; it cannot see repository settings (default token permissions, branch protection, whether the repository is public). Findings about those are review prompts.

  • The retired-action table, the ubuntu-latest mapping and the github.event property table are snapshots (the output says "as of 2025-12" where it matters). Newer deprecations are not in them.

  • The permissions inference knows a few dozen popular actions and gh/git commands. When a job uses anything else it says the inference is partial and does not guess.

  • Reusable-workflow checks cover callees in the same repository only.

Development

uv sync --extra test
uv run pytest
uv run ruff check src tests && uv run mypy --strict src

MIT licensed.

Available Tools

7 tools
explain_triggersB

Explain in plain English when each workflow runs: push/PR filters, which pull request types, fork behaviour, manual inputs, reusable-workflow interface, workflow_run chains, and schedule cron expressions explained with the next 5 run times in UTC (computed by a built-in cron implementation, including the day-of-month OR day-of-week rule). Flags congested schedules (minute 0), intervals under 5 minutes, and reminds that scheduled workflows run only on the default branch and are disabled after 60 days of repository inactivity.

NameRequiredDescriptionDefault
pathYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses that cron evaluation is done by a built-in implementation honouring the day-of-month OR day-of-week rule, that next 5 run times are returned in UTC, and that it emits warnings about congested schedules and intervals under 5 minutes. It also surfaces the GitHub platform constraints (default branch only, disabled after 60 days inactivity). What it omits is the read-only nature and what happens for an invalid or non-workflow path.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the core action, and every clause names a distinct capability rather than padding. The parenthetical about the cron implementation and the day-of-month OR day-of-week rule is dense but earns its place by explaining an easily-misread edge case.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be described, and the behavioural surface is well covered for a read-style inspection tool. The unresolved 'path' argument is the main completeness hole, since an agent cannot tell from the definition what to pass.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter is 'path' with 0% schema description coverage, and the description never mentions it — it does not say whether path is a workflow file, a directory of workflows, or repo-relative. For a single-parameter tool the description is the only place this could be clarified, and it isn't.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource — 'Explain in plain English when each workflow runs' — and enumerates exactly which trigger facets are covered (push/PR filters, fork behaviour, workflow_run chains, cron). It is clearly distinct from lint_workflows or job_graph by scope, though it never names a sibling to route against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is the tool for understanding trigger configuration, but there is no explicit 'use this when...' statement, no exclusion (e.g. 'for validation errors use lint_workflows'), and no note on prerequisites such as needing a checked-out repo.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fix_previewA

Show a unified diff of the safe automatic fixes for a workflow file (or every workflow under a directory): add a top-level permissions: contents: read when every job is recognised as read-only, move injectable ${{ github.event.* }} expressions out of run: scripts into step env: variables, and replace ::set-output with $GITHUB_OUTPUT. The patched text is re-linted to prove the findings disappear and none are introduced. Never writes the file: apply the diff yourself. Lists what needs a manual change.

NameRequiredDescriptionDefault
pathYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses the read-only guarantee explicitly, describes the internal verification loop ('re-linted to prove the findings disappear and none are introduced'), and notes that unfixable items are reported separately. These are non-obvious behavioral traits an agent could not infer from the name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and a concrete enumeration of fix kinds, then closed with the two most decision-relevant facts (no writes, manual items listed). The middle sentence is dense but every clause maps to a distinct behavior; no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return shape need not be explained. Given the tool's simplicity (one path parameter, no nested objects), the description covers scope, fix categories, safety posture, verification, and follow-up action — sufficient for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single `path` parameter has no schema documentation, so the description must compensate. It does: 'a workflow file (or every workflow under a directory)' clarifies that the argument accepts either a file or a directory and implies recursive scope, which is meaningful semantics beyond the bare string type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and artifact: 'Show a unified diff of the safe automatic fixes for a workflow file'. It then enumerates exactly which fix categories are covered (permissions scoping, expression injection into env, set-output replacement), which distinguishes it from lint_workflows (finding problems) and pin_actions_plan (pinning actions) without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Never writes the file: apply the diff yourself' gives a clear operational contract, and 'Lists what needs a manual change' tells the agent this is a proposal, not an application. It stops short of naming an explicit alternative or prerequisite (e.g. run lint_workflows first), so the routing signal is strong but not fully spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

job_graphB

Draw each workflow's job needs: graph as text and as a Mermaid diagram, group jobs into waves that can run in parallel, and show the critical path (longest dependency chain) plus a worst-case duration bound from timeout-minutes. Reports cycles.

NameRequiredDescriptionDefault
pathNo.

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningful behavior: it reports cycles, computes a worst-case duration bound from timeout-minutes, and emits both textual and Mermaid output. It stops short of stating that the operation is read-only and whether it scans all workflow files beneath the given path.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence front-loads the core action and then lists the derived analyses, with no filler. It is slightly packed but every clause adds a distinct capability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value detail is not required, and the description covers the analytical features well. The remaining gap is scope: how `path` selects inputs and whether the tool is read-only, which matters for an agent deciding whether to call it freely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter `path` has 0% schema description coverage and defaults to '.', yet the description never mentions it or explains whether it points to a repo root, a workflow directory, or a specific file. With only one parameter and no schema help, the description should compensate and does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb and resource ('Draw each workflow's job `needs:` graph') and enumerates concrete outputs (text, Mermaid diagram, waves, critical path, duration bound, cycle reporting). This is distinct in kind from siblings like lint_workflows or workflows_overview, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when the tool is appropriate (dependency/parallelism analysis and visualization), but gives no explicit 'use this instead of X when...' guidance and no exclusions, despite six plausible alternative analysis tools in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lint_workflowsA

Lint workflows and composite actions with 33 rules (GHA1001-GHA1033). Each finding has a rule id, severity (error/warning/info), file:line (exact line inside multi-line run: | blocks), an explanation and a concrete fix. Covers: actions not pinned to a commit SHA, pwn requests (pull_request_target / workflow_run + checkout of PR code), script injection through github.event.* / head_ref / inputs inside run: or github-script, missing or write-all permissions, secrets: inherit, secrets echoed or on command lines, curl | bash, checkout credentials left behind, self-hosted runners on PR triggers, deprecated commands (set-output, set-env), timeouts, concurrency, needs mistakes and cycles, always-true if: expressions, unknown/misspelled contexts, matrix size, reusable-workflow input/secret mismatches, retired action versions (dated table), cache keys, continue-on-error, unquoted 3.10 versions, invalid cron. Suppress with # workflowlint-ignore: GHA1003 above the line. Never modifies anything.

NameRequiredDescriptionDefault
pathNo.

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With zero annotations the description carries the full burden and does so well: it declares read-only behavior explicitly ('Never modifies anything'), documents the suppression mechanism and its exact syntax, and states the shape of each finding (rule id, severity tiers, file:line including the exact line inside multi-line `run: |` blocks, explanation, fix). These are the behavioral facts an agent needs before deciding to run it in a pipeline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose, severity model and read-only guarantee are front-loaded, which is good. But the middle is one very long sentence enumerating ~25 checks, several of which (cache keys, matrix size, unquoted 3.10) add little to an agent's decision to invoke the tool and could be compressed to a summary plus examples.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only linter with an output schema already defined, the description covers scope, severity vocabulary, suppression, and a clear mutation guarantee. The one real hole is `path` semantics (what is scanned, recursion, default behavior), which is exactly the information an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description never mentions the single `path` parameter — not whether it is a file, directory, or glob, whether traversal is recursive, or what the default '.' expands to. Given only one self-evidently named parameter, the omission is not fatal, but no meaning is added beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb and resource ('Lint workflows and composite actions'), names the exact rule set (33 rules, GHA1001-GHA1033), and the description scopes it clearly against siblings like fix_preview and pin_actions_plan by being purely diagnostic. An agent can distinguish it from every other tool in the list without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the long 'Covers:' list tells the agent what problems this detects, which implicitly tells it when the tool applies. However, there is no explicit when-to-use/when-not-to-use statement and none of the six siblings (e.g., fix_preview, pin_actions_plan) are named as follow-ups or alternatives, so routing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

permissions_reviewA

Show the effective GITHUB_TOKEN permissions of every job (job-level replaces workflow-level; absent means the repository default), infer what each job actually needs from the actions and gh/git commands it uses, flag write access that looks unnecessary and permissions that are missing, and print a least-privilege permissions: block per job. The inference is heuristic and says when it is partial.

NameRequiredDescriptionDefault
pathNo.

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden, and it does fairly well by explaining the resolution rule (job-level replaces workflow-level; absent means repo default) and the heuristic nature of inference, including that partial results are flagged. It falls short of a 5 because it never states that the tool is read-only and does not scan or modify files, nor what happens when no workflows are found, both of which an agent would want to know before calling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single dense sentence that front-loads the main action and enumerates sub-behaviors in order, with no filler. The run-on structure with multiple em-dash and parenthetical clauses makes it slightly harder to parse than short separate sentences would.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output values need not be explained because an output schema exists, and the description covers the analysis logic, the resolution rule, and heuristic limits well. The remaining gap is the undocumented path parameter and the absence of any statement about read-only behavior, which leaves the definition slightly incomplete for a repo-scanning analysis tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one optional path parameter with a default of '.' and 0% schema description coverage, and the description never mentions it. An agent reading only the description would not know what path refers to (a repo root, a workflow file, or a directory of workflows), which is exactly the kind of gap the description should close at low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it shows the effective GITHUB_TOKEN permissions of every job, infers what each job needs, flags mismatches, and prints a least-privilege permissions block. That is far more concrete than the sibling names (workflows_overview, lint_workflows, job_graph) and makes it clear this tool is the permissions analyzer rather than a general linter or graph view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when it is useful by describing the permissions analysis, but it never says when to choose it over lint_workflows or workflows_overview, nor when not to use it. No prerequisites or scope conditions are stated, so the agent has to infer usage from the purpose alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pin_actions_planA

List every uses: that is not pinned to a full commit SHA (grouped by action version, with file:line) and how to pin each. With online=false (default) nothing touches the network and you get git ls-remote instructions. With online=true each tag or branch is resolved to its commit SHA through api.github.com only (annotated tags are dereferenced; results cached; honest rate-limit messages; an optional GITHUB_TOKEN in the server's environment raises the limit and is sent only to that host). Output is a plan as text: nothing is written.

NameRequiredDescriptionDefault
pathNo.
onlineNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does so thoroughly: network isolation by default, the exact host contacted when online, annotated-tag dereferencing, caching, honest rate-limit messaging, and GITHUB_TOKEN handling scoped to that host only. It also states the operation is non-mutating ('nothing is written').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core promise, then the mode contrast, with no filler sentences. It is dense with parentheticals, which makes it slightly harder to scan than necessary, but each clause carries real information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, yet the description still usefully characterizes the return as a text plan. Network, credential, and mutation behavior are all covered; the only real gap is the unexplained `path` input, which matters for a tool whose scope depends on where it scans.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It fully specifies the semantics of `online` (default false, what each mode does, which host is contacted), but the `path` parameter — which determines the repository root scanned — is never mentioned or clarified beyond its schema default of '.'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — list every `uses:` not pinned to a full commit SHA — plus the output shape (grouped by action version, with file:line) and an added deliverable (how to pin each). This is clearly distinguishable from siblings like lint_workflows or fix_preview.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lays out the two operating modes: online=false (default, no network, `git ls-remote` instructions) versus online=true (resolve tags/branches via api.github.com). It also signals via 'Output is a plan as text: nothing is written' that this is advisory rather than a fixer, implying fix_preview for application, but it never names that sibling or states an exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workflows_overviewA

Summarize GitHub Actions workflows: triggers, jobs with runners and needs, permissions per job, every action used (version, whether pinned to a commit SHA), environments, and the NAMES of the secrets each job references (values are never read). Also covers local composite actions under .github/actions. path is a workflow file, a repo root containing .github/workflows, or the workflows directory. Invalid YAML is reported with its line instead of failing. Start here.

NameRequiredDescriptionDefault
pathNo.

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden well: it discloses that secret values are never read (only names), that invalid YAML is reported with a line number rather than failing, and that local composite actions are included. It never explicitly says the operation is read-only or requires no authentication, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the scope enumeration and closed with the actionable 'Start here', with no filler. The middle sentences are dense and run long, but every clause adds real information about coverage or behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is unnecessary, and the description covers scope, input forms, and error behavior for a fairly complex analysis tool. The missing pieces are minor: no explicit read-only assurance and no mention of the '.' default, both of which an agent would otherwise have to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: `path` is defined as a workflow file, a repo root containing .github/workflows, or the workflows directory. The default value of '.' is never mentioned and no example path is given, so a small gap remains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Summarize) and resource (GitHub Actions workflows) and then enumerates exactly what is covered: triggers, jobs with runners and needs, per-job permissions, actions with pin status, environments, secret names, and local composite actions. An agent knows precisely what this returns without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The closing 'Start here' gives clear entry-point guidance that positions it ahead of the sibling tools (lint_workflows, job_graph, permissions_review, etc.), and the path sentence explains the three accepted input shapes. It stops short of naming any sibling or saying when to prefer a narrower tool, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedexplain_triggers
    • First observedfix_preview
    • First observedjob_graph
    • First observedlint_workflows
    • First observedpermissions_review
    • First observedpin_actions_plan
    • First observedworkflows_overview

TDQS

A3.9/5.0

Scored across 7 tools

Disambiguation4/5

Each tool has a recognizable specialization: summary, rule-based linting, trigger explanation, token permissions, job dependency graph, action pinning, and fix diffs. There is mild overlap where workflows_overview already reports permissions and pinned/unpinned actions that permissions_review and pin_actions_plan dig into, and lint_workflows also flags unpinned actions and permission issues. The descriptions make clear which is the deep-dive versus the summary, so misselection is unlikely but not impossible.

Naming Consistency3/5

All names are snake_case and readable, but the verb/noun ordering is inconsistent: verb_noun in lint_workflows, explain_triggers, pin_actions_plan, fix_preview, versus noun_verb in workflows_overview and permissions_review, plus the bare noun job_graph. An agent can still infer behavior, but there is no single predictable pattern.

Tool Count5/5

Seven tools is well within the ideal range and each one maps to a distinct analysis concern of a GitHub Actions auditing server. No tool feels redundant padding or conspicuously absent from the set.

Completeness4/5

The surface covers the full read-only audit lifecycle: inventory, linting, trigger semantics, permissions, dependency graph, pinning plan, and a fix diff with re-lint verification. The main gap is that fix_preview never applies changes and there is no write/apply tool, so remediation is a manual dead end by design; cross-file or multi-repo bulk analysis is also absent. These are workaroundable but limit end-to-end automation.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Local-only GitHub Actions and CI maintenance scanner for AI-built apps. Exposes scan, explanation, and fix-planning tools to MCP clients; modifies nothing and makes no outbound requests by default.
    3
    56 npm
    2
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Audits GitHub Actions workflow files for supply-chain risks like script injection, leaked tokens, unpinned actions, and broad permissions.
    -
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP clients to run deterministic, read-only local repository audits for risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration, returning structured findings without sending source code to a service.
    50 npm
    MIT