workflowlint-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@workflowlint-mcpAudit my GitHub Actions workflows and preview safe fixes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
workflowlint-mcp
An MCP server that lets an AI audit GitHub Actions workflows: security and correctness findings with a
rule ID, severity, file:line (exact even inside multi-line run: | blocks) and a concrete fix, plus a cron
explainer with the next run times, a needs graph with critical path, a least-privilege permissions review,
a commit-SHA pin plan and a diff of the safe automatic fixes. It is read-only, offline by default, and needs
no external binary.
How it differs from what exists. The GitHub Actions MCP servers I could find either wrap
actionlint (a Go binary you must install; it
checks syntax and shell, not supply-chain risk) or are hosted scanners such as
github-actions-audit and
github-actions-audit-mcp, which
report findings but do not explain schedules, draw job graphs, review token permissions, or produce
patches. This server is pure Python (mcp + pyyaml), runs locally, and adds: a position-aware YAML model
(so on: is not the boolean True, 3.10 is flagged, anchors resolve, and every finding has a real line),
script-injection analysis that knows the dangerous github.event.* contexts, a built-in cron engine, a
fix_preview that proves each patch by re-linting it, and an opt-in online SHA resolver that talks to
api.github.com only.
Install
Claude Code:
claude mcp add workflowlint -- uvx workflowlint-mcp --dir .Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"workflowlint": {
"command": "uvx",
"args": ["workflowlint-mcp", "--dir", "C:\\path\\to\\your\\repo"]
}
}
}Without uv: pip install workflowlint-mcp, then run workflowlint-mcp --dir /path/to/repo.
Flag | Meaning |
| Only files inside this directory can be read (default: the current directory). |
| Comma-separated rule ids to turn off, e.g. |
(There is also an undocumented --github-api-url flag that tests use to point the online pin lookup at a
local fake server. It is a server flag, not a tool argument, so a model cannot use it.)
Silence one finding in the file itself with a comment on the line above it (or at the end of the line):
# workflowlint-ignore: GHA1001, GHA1003
- uses: some/action@v1Related MCP server: github-actions-audit
Tools
Tool | What it does |
| Workflows, triggers, jobs, runners, |
| 33 rules (GHA1001-GHA1033) with severity, |
| When each workflow runs, in plain English. Cron expressions are explained with the next 5 run times in UTC from a built-in cron engine (including the day-of-month/day-of-week OR rule), plus notes on congestion, the 5-minute minimum, default-branch-only schedules and the 60-day inactivity shutdown. |
| Effective |
| The |
| Every |
| Unified diff of the safe fixes: read-only |
path is a workflow file, a repository root containing .github/workflows, or the workflows directory,
relative to --dir or absolute inside it. Local composite actions (.github/actions/**/action.yml) are included.
Try asking
"Audit my GitHub Actions workflows and fix everything that is safe."
"Is any workflow vulnerable to script injection or a pwn request?"
"Which actions are not pinned to a commit SHA? Look the SHAs up." (
online=true; setGITHUB_TOKENto avoid the 60 requests/hour limit)"When does the nightly workflow run next? Why did it not run last week?"
"What permissions does each job really need? Give me a least-privilege
permissions:block.""Draw the job graph for the release workflow and tell me the critical path."
"Review my reusable workflow call: do the inputs and secrets match?"
Rules
ID | Severity | Rule |
GHA1000 | error | file is not valid YAML (reported with its line instead of failing) |
GHA1001 | error / warning / info | action is not pinned to a full commit SHA (third-party branch = error, third-party tag = warning, |
GHA1002 | error |
|
GHA1003 | error | untrusted expression expanded inside |
GHA1004 | warning | no |
GHA1005 | error |
|
GHA1006 | warning |
|
GHA1007 | warning / error | secret printed or interpolated into a command line |
GHA1008 | warning | downloads and executes a script in one step ( |
GHA1009 | warning / info | checkout leaves the token in |
GHA1010 | warning | self-hosted runner reachable from pull requests or other outsider events |
GHA1011 | warning / error | deprecated workflow command ( |
GHA1012 | error |
|
GHA1013 | info | job has no |
GHA1014 | info | deploy-like job without a concurrency group |
GHA1015 | error |
|
GHA1016 | error |
|
GHA1017 | error |
|
GHA1018 | error | unknown context in an expression |
GHA1019 | warning | misspelled |
GHA1020 | error | matrix is empty or larger than 256 jobs |
GHA1021 | info | runner label tracks |
GHA1022 | error | call does not match the reusable workflow's inputs/secrets (same repository) |
GHA1023 | error / warning | retired or deprecated action version (dated table) |
GHA1024 | error | upload-artifact and download-artifact majors are incompatible |
GHA1025 | warning | cache key has no content hash |
GHA1026 | warning / info |
|
GHA1027 | error | structure problem: missing |
GHA1028 | warning | unquoted version number loses its trailing zero ( |
GHA1029 | error | invalid cron expression in |
GHA1030 | info | schedule at minute 0 or more often than every 5 minutes |
GHA1031 | error | composite action |
GHA1032 | info | job is granted write access it does not appear to use |
GHA1033 | error | duplicate mapping key |
The injection contexts checked by GHA1003 are the documented attacker-writable fields: issue, pull request,
discussion, comment and review titles and bodies; pull_request.head.ref/label/repo.*; commit messages and
author/committer names and emails (head_commit, commits[*], workflow_run.head_commit); head_branch
and display_title of a workflow run; release name/body/tag; client_payload.*; github.head_ref. Workflow
inputs and github.ref_name are reported as warnings (the person who starts the run chooses them).
Security
Read-only. No tool writes a file or runs a command.
fix_previewandpin_actions_planreturn text.Sandboxed. Every path is resolved (symlinks included) and must stay inside
--dir. Files are capped at 1 MB and 20,000 lines and must be UTF-8.YAML is parsed safely. Only PyYAML's composer is used (no object construction, no tags executed). Alias expansion is capped at 100,000 nodes and 20 MB of text, nesting at 60 levels, so alias bombs become a finding, not a hang.
Secrets: names only. Findings and overviews show
secrets.NAME, never a value. As a last line of defence every output passes through a redactor that masks well-known token formats,://user:pass@URLs andpassword: literallines, so a literal secret in a diff context line is not repeated to the model.The network is off by default.
pin_actions_plan(online=true)contacts exactly one host,api.github.com(validated owner/repo/ref characters, 10 s timeout, redirects only to the same host, at most 60 lookups per call, results cached). IfGITHUB_TOKENis set in the server's environment it is sent only as theAuthorizationheader to that host and is never printed. Rate limits are reported honestly with the reset time.
Limits you should know about
It reads files; it cannot see repository settings (default token permissions, branch protection, whether the repository is public). Findings about those are review prompts.
The retired-action table, the
ubuntu-latestmapping and thegithub.eventproperty table are snapshots (the output says "as of 2025-12" where it matters). Newer deprecations are not in them.The permissions inference knows a few dozen popular actions and
gh/gitcommands. When a job uses anything else it says the inference is partial and does not guess.Reusable-workflow checks cover callees in the same repository only.
Development
uv sync --extra test
uv run pytest
uv run ruff check src tests && uv run mypy --strict srcMIT licensed.
Available Tools
7 toolsexplain_triggersB
Explain in plain English when each workflow runs: push/PR filters, which pull request types, fork
behaviour, manual inputs, reusable-workflow interface, workflow_run chains, and schedule cron
expressions explained with the next 5 run times in UTC (computed by a built-in cron implementation,
including the day-of-month OR day-of-week rule). Flags congested schedules (minute 0), intervals under
5 minutes, and reminds that scheduled workflows run only on the default branch and are disabled after
60 days of repository inactivity.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses that cron evaluation is done by a built-in implementation honouring the day-of-month OR day-of-week rule, that next 5 run times are returned in UTC, and that it emits warnings about congested schedules and intervals under 5 minutes. It also surfaces the GitHub platform constraints (default branch only, disabled after 60 days inactivity). What it omits is the read-only nature and what happens for an invalid or non-workflow path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the core action, and every clause names a distinct capability rather than padding. The parenthetical about the cron implementation and the day-of-month OR day-of-week rule is dense but earns its place by explaining an easily-misread edge case.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be described, and the behavioural surface is well covered for a read-style inspection tool. The unresolved 'path' argument is the main completeness hole, since an agent cannot tell from the definition what to pass.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter is 'path' with 0% schema description coverage, and the description never mentions it — it does not say whether path is a workflow file, a directory of workflows, or repo-relative. For a single-parameter tool the description is the only place this could be clarified, and it isn't.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource — 'Explain in plain English when each workflow runs' — and enumerates exactly which trigger facets are covered (push/PR filters, fork behaviour, workflow_run chains, cron). It is clearly distinct from lint_workflows or job_graph by scope, though it never names a sibling to route against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the tool for understanding trigger configuration, but there is no explicit 'use this when...' statement, no exclusion (e.g. 'for validation errors use lint_workflows'), and no note on prerequisites such as needing a checked-out repo.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fix_previewA
Show a unified diff of the safe automatic fixes for a workflow file (or every workflow under a
directory): add a top-level permissions: contents: read when every job is recognised as read-only,
move injectable ${{ github.event.* }} expressions out of run: scripts into step env: variables,
and replace ::set-output with $GITHUB_OUTPUT. The patched text is re-linted to prove the findings
disappear and none are introduced. Never writes the file: apply the diff yourself. Lists what needs a
manual change.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the read-only guarantee explicitly, describes the internal verification loop ('re-linted to prove the findings disappear and none are introduced'), and notes that unfixable items are reported separately. These are non-obvious behavioral traits an agent could not infer from the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and a concrete enumeration of fix kinds, then closed with the two most decision-relevant facts (no writes, manual items listed). The middle sentence is dense but every clause maps to a distinct behavior; no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return shape need not be explained. Given the tool's simplicity (one path parameter, no nested objects), the description covers scope, fix categories, safety posture, verification, and follow-up action — sufficient for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single `path` parameter has no schema documentation, so the description must compensate. It does: 'a workflow file (or every workflow under a directory)' clarifies that the argument accepts either a file or a directory and implies recursive scope, which is meaningful semantics beyond the bare string type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and artifact: 'Show a unified diff of the safe automatic fixes for a workflow file'. It then enumerates exactly which fix categories are covered (permissions scoping, expression injection into env, set-output replacement), which distinguishes it from lint_workflows (finding problems) and pin_actions_plan (pinning actions) without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Never writes the file: apply the diff yourself' gives a clear operational contract, and 'Lists what needs a manual change' tells the agent this is a proposal, not an application. It stops short of naming an explicit alternative or prerequisite (e.g. run lint_workflows first), so the routing signal is strong but not fully spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_graphB
Draw each workflow's job needs: graph as text and as a Mermaid diagram, group jobs into waves
that can run in parallel, and show the critical path (longest dependency chain) plus a worst-case
duration bound from timeout-minutes. Reports cycles.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose meaningful behavior: it reports cycles, computes a worst-case duration bound from timeout-minutes, and emits both textual and Mermaid output. It stops short of stating that the operation is read-only and whether it scans all workflow files beneath the given path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence front-loads the core action and then lists the derived analyses, with no filler. It is slightly packed but every clause adds a distinct capability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is not required, and the description covers the analytical features well. The remaining gap is scope: how `path` selects inputs and whether the tool is read-only, which matters for an agent deciding whether to call it freely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter `path` has 0% schema description coverage and defaults to '.', yet the description never mentions it or explains whether it points to a repo root, a workflow directory, or a specific file. With only one parameter and no schema help, the description should compensate and does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb and resource ('Draw each workflow's job `needs:` graph') and enumerates concrete outputs (text, Mermaid diagram, waves, critical path, duration bound, cycle reporting). This is distinct in kind from siblings like lint_workflows or workflows_overview, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when the tool is appropriate (dependency/parallelism analysis and visualization), but gives no explicit 'use this instead of X when...' guidance and no exclusions, despite six plausible alternative analysis tools in the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lint_workflowsA
Lint workflows and composite actions with 33 rules (GHA1001-GHA1033). Each finding has a rule id,
severity (error/warning/info), file:line (exact line inside multi-line run: | blocks), an
explanation and a concrete fix. Covers: actions not pinned to a commit SHA, pwn requests
(pull_request_target / workflow_run + checkout of PR code), script injection through
github.event.* / head_ref / inputs inside run: or github-script, missing or write-all permissions,
secrets: inherit, secrets echoed or on command lines, curl | bash, checkout credentials left behind,
self-hosted runners on PR triggers, deprecated commands (set-output, set-env), timeouts, concurrency,
needs mistakes and cycles, always-true if: expressions, unknown/misspelled contexts, matrix size,
reusable-workflow input/secret mismatches, retired action versions (dated table), cache keys,
continue-on-error, unquoted 3.10 versions, invalid cron. Suppress with
# workflowlint-ignore: GHA1003 above the line. Never modifies anything.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations the description carries the full burden and does so well: it declares read-only behavior explicitly ('Never modifies anything'), documents the suppression mechanism and its exact syntax, and states the shape of each finding (rule id, severity tiers, file:line including the exact line inside multi-line `run: |` blocks, explanation, fix). These are the behavioral facts an agent needs before deciding to run it in a pipeline.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose, severity model and read-only guarantee are front-loaded, which is good. But the middle is one very long sentence enumerating ~25 checks, several of which (cache keys, matrix size, unquoted 3.10) add little to an agent's decision to invoke the tool and could be compressed to a summary plus examples.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only linter with an output schema already defined, the description covers scope, severity vocabulary, suppression, and a clear mutation guarantee. The one real hole is `path` semantics (what is scanned, recursion, default behavior), which is exactly the information an agent needs to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions the single `path` parameter — not whether it is a file, directory, or glob, whether traversal is recursive, or what the default '.' expands to. Given only one self-evidently named parameter, the omission is not fatal, but no meaning is added beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a specific verb and resource ('Lint workflows and composite actions'), names the exact rule set (33 rules, GHA1001-GHA1033), and the description scopes it clearly against siblings like fix_preview and pin_actions_plan by being purely diagnostic. An agent can distinguish it from every other tool in the list without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the long 'Covers:' list tells the agent what problems this detects, which implicitly tells it when the tool applies. However, there is no explicit when-to-use/when-not-to-use statement and none of the six siblings (e.g., fix_preview, pin_actions_plan) are named as follow-ups or alternatives, so routing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
permissions_reviewA
Show the effective GITHUB_TOKEN permissions of every job (job-level replaces workflow-level; absent
means the repository default), infer what each job actually needs from the actions and gh/git commands
it uses, flag write access that looks unnecessary and permissions that are missing, and print a
least-privilege permissions: block per job. The inference is heuristic and says when it is partial.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden, and it does fairly well by explaining the resolution rule (job-level replaces workflow-level; absent means repo default) and the heuristic nature of inference, including that partial results are flagged. It falls short of a 5 because it never states that the tool is read-only and does not scan or modify files, nor what happens when no workflows are found, both of which an agent would want to know before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single dense sentence that front-loads the main action and enumerates sub-behaviors in order, with no filler. The run-on structure with multiple em-dash and parenthetical clauses makes it slightly harder to parse than short separate sentences would.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output values need not be explained because an output schema exists, and the description covers the analysis logic, the resolution rule, and heuristic limits well. The remaining gap is the undocumented path parameter and the absence of any statement about read-only behavior, which leaves the definition slightly incomplete for a repo-scanning analysis tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one optional path parameter with a default of '.' and 0% schema description coverage, and the description never mentions it. An agent reading only the description would not know what path refers to (a repo root, a workflow file, or a directory of workflows), which is exactly the kind of gap the description should close at low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it shows the effective GITHUB_TOKEN permissions of every job, infers what each job needs, flags mismatches, and prints a least-privilege permissions block. That is far more concrete than the sibling names (workflows_overview, lint_workflows, job_graph) and makes it clear this tool is the permissions analyzer rather than a general linter or graph view.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when it is useful by describing the permissions analysis, but it never says when to choose it over lint_workflows or workflows_overview, nor when not to use it. No prerequisites or scope conditions are stated, so the agent has to infer usage from the purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_actions_planA
List every uses: that is not pinned to a full commit SHA (grouped by action version, with
file:line) and how to pin each. With online=false (default) nothing touches the network and you get
git ls-remote instructions. With online=true each tag or branch is resolved to its commit SHA through
api.github.com only (annotated tags are dereferenced; results cached; honest rate-limit messages; an
optional GITHUB_TOKEN in the server's environment raises the limit and is sent only to that host).
Output is a plan as text: nothing is written.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . | |
| online | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full burden and does so thoroughly: network isolation by default, the exact host contacted when online, annotated-tag dereferencing, caching, honest rate-limit messaging, and GITHUB_TOKEN handling scoped to that host only. It also states the operation is non-mutating ('nothing is written').
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core promise, then the mode contrast, with no filler sentences. It is dense with parentheticals, which makes it slightly harder to scan than necessary, but each clause carries real information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still usefully characterizes the return as a text plan. Network, credential, and mutation behavior are all covered; the only real gap is the unexplained `path` input, which matters for a tool whose scope depends on where it scans.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It fully specifies the semantics of `online` (default false, what each mode does, which host is contacted), but the `path` parameter — which determines the repository root scanned — is never mentioned or clarified beyond its schema default of '.'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — list every `uses:` not pinned to a full commit SHA — plus the output shape (grouped by action version, with file:line) and an added deliverable (how to pin each). This is clearly distinguishable from siblings like lint_workflows or fix_preview.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly lays out the two operating modes: online=false (default, no network, `git ls-remote` instructions) versus online=true (resolve tags/branches via api.github.com). It also signals via 'Output is a plan as text: nothing is written' that this is advisory rather than a fixer, implying fix_preview for application, but it never names that sibling or states an exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workflows_overviewA
Summarize GitHub Actions workflows: triggers, jobs with runners and needs, permissions per job,
every action used (version, whether pinned to a commit SHA), environments, and the NAMES of the secrets
each job references (values are never read). Also covers local composite actions under .github/actions.
path is a workflow file, a repo root containing .github/workflows, or the workflows directory.
Invalid YAML is reported with its line instead of failing. Start here.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden well: it discloses that secret values are never read (only names), that invalid YAML is reported with a line number rather than failing, and that local composite actions are included. It never explicitly says the operation is read-only or requires no authentication, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the scope enumeration and closed with the actionable 'Start here', with no filler. The middle sentences are dense and run long, but every clause adds real information about coverage or behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is unnecessary, and the description covers scope, input forms, and error behavior for a fairly complex analysis tool. The missing pieces are minor: no explicit read-only assurance and no mention of the '.' default, both of which an agent would otherwise have to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: `path` is defined as a workflow file, a repo root containing .github/workflows, or the workflows directory. The default value of '.' is never mentioned and no example path is given, so a small gap remains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Summarize) and resource (GitHub Actions workflows) and then enumerates exactly what is covered: triggers, jobs with runners and needs, per-job permissions, actions with pin status, environments, secret names, and local composite actions. An agent knows precisely what this returns without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The closing 'Start here' gives clear entry-point guidance that positions it ahead of the sibling tools (lint_workflows, job_graph, permissions_review, etc.), and the path sentence explains the three accepted input shapes. It stops short of naming any sibling or saying when to prefer a narrower tool, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
explain_triggers - First observed
fix_preview - First observed
job_graph - First observed
lint_workflows - First observed
permissions_review - First observed
pin_actions_plan - First observed
workflows_overview
TDQS
Scored across 7 tools
Each tool has a recognizable specialization: summary, rule-based linting, trigger explanation, token permissions, job dependency graph, action pinning, and fix diffs. There is mild overlap where workflows_overview already reports permissions and pinned/unpinned actions that permissions_review and pin_actions_plan dig into, and lint_workflows also flags unpinned actions and permission issues. The descriptions make clear which is the deep-dive versus the summary, so misselection is unlikely but not impossible.
All names are snake_case and readable, but the verb/noun ordering is inconsistent: verb_noun in lint_workflows, explain_triggers, pin_actions_plan, fix_preview, versus noun_verb in workflows_overview and permissions_review, plus the bare noun job_graph. An agent can still infer behavior, but there is no single predictable pattern.
Seven tools is well within the ideal range and each one maps to a distinct analysis concern of a GitHub Actions auditing server. No tool feels redundant padding or conspicuously absent from the set.
The surface covers the full read-only audit lifecycle: inventory, linting, trigger semantics, permissions, dependency graph, pinning plan, and a fix diff with re-lint verification. The main gap is that fix_preview never applies changes and there is no write/apply tool, so remediation is a manual dead end by design; cross-file or multi-repo bulk analysis is also absent. These are workaroundable but limit end-to-end automation.
Maintenance
Related MCP Connectors
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.
GitHub security scanning, code audit, and workflow automation for repositories.
Finds the GitHub Actions workflow eating your CI bill and suggests fix diffs, verified against runs.
Related MCP Servers
- AlicenseAqualityCmaintenanceLocal-only GitHub Actions and CI maintenance scanner for AI-built apps. Exposes scan, explanation, and fix-planning tools to MCP clients; modifies nothing and makes no outbound requests by default.356 npm2MIT
- FlicenseNot gradedqualityDmaintenanceAudits GitHub Actions workflow files for supply-chain risks like script injection, leaked tokens, unpinned actions, and broad permissions.-
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to run deterministic, read-only local repository audits for risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration, returning structured findings without sending source code to a service.50 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to run local, read-only audits that detect risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration before merging.50 npmMIT