agent-audit-kit/action.yml at main · sattyamjjain/agent-audit-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: 'AgentAuditKit MCP Security Scan'
description: 'AgentAuditKit — MCP Security Scan (330 rules, OWASP Agentic Top 10 + MCP Top 10)'
author: 'sattyamjjain'

branding:
  icon: 'shield'
  color: 'red'

inputs:
  path:
    description: 'Project directory to scan'
    required: false
    default: '.'
  severity:
    description: 'Minimum severity to report (critical, high, medium, low, info)'
    required: false
    default: 'low'
  fail-on:
    description: 'Fail the action if findings at or above this severity (critical, high, medium, low, none)'
    required: false
    default: 'high'
  format:
    description: 'Output format (console, json, sarif)'
    required: false
    default: 'sarif'
  upload-sarif:
    description: 'Emit SARIF for GitHub Code Scanning. NOTE: this action does not upload directly — it writes the SARIF (see the `sarif-file` output) and prints a notice; you add a `github/codeql-action/upload-sarif` step with `security-events: write`. See README > SARIF Integration.'
    required: false
    default: 'true'
  include-user-config:
    description: 'Also scan user-level agent configs (~/.claude/)'
    required: false
    default: 'false'
  rules:
    description: 'Comma-separated rule IDs to run (default: all)'
    required: false
    default: ''
  exclude-rules:
    description: 'Comma-separated rule IDs to skip'
    required: false
    default: ''
  preset:
    description: 'Activate a curated rule preset (e.g. "mcp-ox-2026-04"). Equivalent to --preset on the CLI.'
    required: false
    default: ''
  ignore-paths:
    description: 'Comma-separated paths to skip during scan'
    required: false
    default: ''
  config:
    description: 'Path to .agent-audit-kit.yml configuration file'
    required: false
    default: ''
  comment-on-pr:
    description: 'Post a sticky PR comment summarising findings (requires pull-request event + issues:write). A Markdown table is also written to $GITHUB_STEP_SUMMARY in every run.'
    required: false
    default: 'true'
  fingerprint-strategy:
    description: 'SARIF fingerprint mode. "auto" (default) uses content-hash when source is co-located, else location-hash — matches GitHub Code Scanning de-dup. "line-hash" forces content-hash; "disabled" emits no fingerprints (for marketplace runners that compute them downstream). GH Code Scanning requires self-emitted fingerprints when the SARIF uploader is not co-located with source: https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning'
    required: false
    default: 'auto'

outputs:
  findings-count:
    description: 'Total number of findings'
  critical-count:
    description: 'Number of critical findings'
  high-count:
    description: 'Number of high severity findings'
  sarif-file:
    description: 'Path to the SARIF output file'
  exit-code:
    description: 'Exit code from the scan (0=pass, 1=findings exceed threshold, 2=error)'

runs:
  using: 'docker'
  image: 'Dockerfile'
  args:
    - ${{ inputs.path }}
    - ${{ inputs.severity }}
    - ${{ inputs.fail-on }}
    - ${{ inputs.format }}
    - ${{ inputs.upload-sarif }}
    - ${{ inputs.include-user-config }}
    - ${{ inputs.rules }}
    - ${{ inputs.exclude-rules }}
    - ${{ inputs.preset }}
    - ${{ inputs.ignore-paths }}
    - ${{ inputs.config }}
    - ${{ inputs.comment-on-pr }}
    - ${{ inputs.fingerprint-strategy }}