Skip to main content
Glama
workflowlint-mcp
by 0xmortuex

pin_actions_plan

Lists every GitHub Actions uses: entry not pinned to a full commit SHA, grouped by version with file:line, and returns a text plan for pinning each, optionally resolving tags online.

Instructions

List every uses: that is not pinned to a full commit SHA (grouped by action version, with file:line) and how to pin each. With online=false (default) nothing touches the network and you get git ls-remote instructions. With online=true each tag or branch is resolved to its commit SHA through api.github.com only (annotated tags are dereferenced; results cached; honest rate-limit messages; an optional GITHUB_TOKEN in the server's environment raises the limit and is sent only to that host). Output is a plan as text: nothing is written.

Input Schema

NameRequiredDescriptionDefault
pathNo.
onlineNo

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does so thoroughly: network isolation by default, the exact host contacted when online, annotated-tag dereferencing, caching, honest rate-limit messaging, and GITHUB_TOKEN handling scoped to that host only. It also states the operation is non-mutating ('nothing is written').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core promise, then the mode contrast, with no filler sentences. It is dense with parentheticals, which makes it slightly harder to scan than necessary, but each clause carries real information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, yet the description still usefully characterizes the return as a text plan. Network, credential, and mutation behavior are all covered; the only real gap is the unexplained `path` input, which matters for a tool whose scope depends on where it scans.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It fully specifies the semantics of `online` (default false, what each mode does, which host is contacted), but the `path` parameter — which determines the repository root scanned — is never mentioned or clarified beyond its schema default of '.'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — list every `uses:` not pinned to a full commit SHA — plus the output shape (grouped by action version, with file:line) and an added deliverable (how to pin each). This is clearly distinguishable from siblings like lint_workflows or fix_preview.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lays out the two operating modes: online=false (default, no network, `git ls-remote` instructions) versus online=true (resolve tags/branches via api.github.com). It also signals via 'Output is a plan as text: nothing is written' that this is advisory rather than a fixer, implying fix_preview for application, but it never names that sibling or states an exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.