mcpgawk/action.yml at main · gawk-dev/mcpgawk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
name: 'mcpgawk MCP hygiene gate'
description: 'Fail the build when an MCP server your agents can reach changes, costs too much context, or can do more than you approved. Runs on the runner; nothing is uploaded.'
author: 'Nativerse Ventures'
branding:
  icon: 'shield'
  color: 'orange'

inputs:
  config:
    description: 'Path to an mcp.json config to scan.'
    required: false
    default: 'mcp.json'
  stdio:
    description: 'A single stdio server command to scan instead of a config (e.g. "npx -y @modelcontextprotocol/server-filesystem@2026.8.31 /tmp" — pin the version, an unpinned npx installs whatever upstream publishes next and mcpgawk flags it).'
    required: false
    default: ''
  http:
    description: 'A single streamable-HTTP MCP server URL to scan.'
    required: false
    default: ''
  sse:
    description: 'A single SSE MCP server URL to scan.'
    required: false
    default: ''
  max-tokens:
    description: 'Fail the build if any server loads more than this many tokens at connect. 0 = no budget.'
    required: false
    default: '0'
  fail-on-flagged:
    description: 'Fail the build if any server trips a bounded signal (injection-shaped / shadowing / undeclared).'
    required: false
    default: 'false'
  version:
    description: 'mcpgawk version to install from PyPI ("latest" or e.g. "0.1.2").'
    required: false
    default: 'latest'

runs:
  using: 'composite'
  steps:
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'
    - name: Install mcpgawk
      shell: bash
      run: |
        if [ "${{ inputs.version }}" = "latest" ]; then
          pip install --quiet --disable-pip-version-check mcpgawk
        else
          pip install --quiet --disable-pip-version-check "mcpgawk==${{ inputs.version }}"
        fi
    - name: Scan and gate
      shell: bash
      env:
        MCPGAWK_CONFIG: ${{ inputs.config }}
        MCPGAWK_STDIO: ${{ inputs.stdio }}
        MCPGAWK_HTTP: ${{ inputs.http }}
        MCPGAWK_SSE: ${{ inputs.sse }}
        MCPGAWK_MAX_TOKENS: ${{ inputs.max-tokens }}
        MCPGAWK_FAIL_ON_FLAGGED: ${{ inputs.fail-on-flagged }}
      run: python "${{ github.action_path }}/scripts/ci_gate.py"