"author:actions-marketplace-validations" matching MCP servers:

Enables building structured release evidence by comparing two Git refs and correlating commits, merged pull requests, linked issues, labels, changed files, and contributors.

Enables MCP clients to run local, read-only audits that detect risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration before merging.

Lets an agent inspect and audit MCP servers before connecting to them, checking their exposed tools, prompts and resources for tool poisoning, shadowing, excessive permissions, leaked secrets and unsafe transports against 24 deterministic rules. Results are returned as findings with evidence, remediation and CWE/OWASP references, and can fail CI with SARIF, Markdown or standalone HTML reports.

Enables agents to vet MCP servers and agent configurations before trusting them, using local static analysis to detect injection, dangerous capabilities, exfiltration paths, and CVEs, with policy-based gating for CI.