Skip to main content
Glama

Review GitHub Actions workflows

check_workflows
Read-onlyIdempotent

Reviews GitHub Actions workflow files to detect outdated actions, deprecated Node runtimes, retired runners, deprecated commands, and security risks, with file, line, and fix for each finding.

Instructions

Reviews up to 30 workflow files (path and content): outdated actions and the SHA to pin, actions on deprecated Node runtimes, runner labels GitHub no longer provides, deprecated commands (set-output), script injection and pull_request_target risks. Findings with file, line and fix.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
filesYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
countsYes
findingsYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, and non-destructive behavior, and the description is consistent with these. It adds useful behavioral detail by stating that the tool analyzes provided path/content pairs and returns findings with file, line, and fix.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the resource and limit, then presents checks and output in a compact, scannable list. Every clause adds information and there is no repetition of schema or annotation details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with a rich output schema and comprehensive annotations, the description covers the input contract, the analysis categories, and the output shape. It lacks only explicit routing guidance relative to siblings, which was already penalized under usage guidelines.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does by explaining that 'files' are workflow files consisting of path and content, implicitly reinforcing the required structure and the 30-file limit. It could add more about content format, but the meaning is clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Reviews') with a clear resource ('up to 30 workflow files') and enumerates the exact checks performed. It is unambiguous about what the tool does and is easily distinguished from siblings by its review-oriented scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for reviewing workflow files for security and maintenance issues, but it does not explicitly state when to prefer this over the sibling tools action_versions or runner_labels. Usage context is present only by inference from the listed checks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools