How do I install the github actions audit mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `GITHUB_TOKEN` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

GitHub Actions Audit MCP Server

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.

Remote serverstreamable-http

What is the GitHub Actions Audit MCP Server?

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection.

What it actually does

Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a workflow YAML, and get back structured findings with:

Severity — — critical / high / medium / low / info
Affected job and step — — exact location of the problem
Description — — why it matters, with the actual attack vector
Remediation — — what to do about it
Fix snippet — — YAML you can paste directly

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the GitHub Actions Audit MCP Server

{
  "mcpServers": {
    "gha-audit": {
      "transport": "streamable-http",
      "url": "https://YOUR-ACTOR-URL.apify.actor/mcp"
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

Variable	Description	Required
GITHUB_TOKEN	Credential the server authenticates with.	Yes

Frequently asked questions

GitHub Actions workflow security audit - 21 checks: pinning, permissions, secrets, injection. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.