action.yml

name: 'ToolTrust MCP Security Scanner'
description: 'Scan MCP server tools for prompt injection, privilege escalation, and supply-chain attacks. Each tool gets a trust grade (A–F) and a gateway policy (ALLOW / REQUIRE_APPROVAL / BLOCK). Fail your CI if a server exceeds your risk threshold.'
author: 'AgentSafe-AI'
branding:
  icon: 'shield'
  color: 'blue'

inputs:
  server:
    description: 'The live MCP server command to scan (e.g., "npx -y @modelcontextprotocol/server-filesystem /tmp"). Mutually exclusive with input.'
    required: false
  input:
    description: 'The path to a local tools.json file (mutually exclusive with server).'
    required: false
  fail-on:
    description: 'The grade threshold to fail the CI. (allow | approval | block). Default is "approval" (fails on C, D, F).'
    required: false
    default: 'approval'

  deep-scan:
    description: 'Enable AI-based semantic analysis for deep prompt injection detection (~22MB model).'
    required: false
    default: 'false'

outputs:
  grade:
    description: "The overall scan grade (A, B, C, D, F)"
    value: ${{ steps.scan.outputs.grade }}
  score:
    description: "The numeric risk score of the scan"
    value: ${{ steps.scan.outputs.score }}
  result:
    description: "The full JSON output of the scan report"
    value: ${{ steps.scan.outputs.result }}

runs:
  using: 'composite'
  steps:
    - name: Download ToolTrust Scanner
      shell: bash
      run: |
        OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
        ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')"
        URL="https://github.com/AgentSafe-AI/tooltrust-scanner/releases/latest/download/tooltrust-scanner_${OS}_${ARCH}"
        mkdir -p "$GITHUB_WORKSPACE/.tooltrust/bin"
        curl -fsSL "$URL" -o "$GITHUB_WORKSPACE/.tooltrust/bin/tooltrust"
        chmod +x "$GITHUB_WORKSPACE/.tooltrust/bin/tooltrust"
        echo "$GITHUB_WORKSPACE/.tooltrust/bin" >> $GITHUB_PATH

    - name: Run ToolTrust Scanner
      id: scan
      shell: bash
      run: |
        if [ -n "${{ inputs.server }}" ] && [ -n "${{ inputs.input }}" ]; then
          echo "::error::Inputs 'server' and 'input' are mutually exclusive. Please provide exactly one."
          exit 1
        fi
        
        REPORT_FILE="$(mktemp)"
        
        # Turn off exit immediately so we can parse the JSON even if the scan fails
        set +e
        
        DEEP_SCAN_FLAG=""
        if [ "${{ inputs.deep-scan }}" = "true" ]; then
          DEEP_SCAN_FLAG="--deep-scan"
        fi

        if [ -n "${{ inputs.server }}" ]; then
          tooltrust scan --server "${{ inputs.server }}" --fail-on "${{ inputs.fail-on }}" $DEEP_SCAN_FLAG --output json --file "$REPORT_FILE" >/dev/null
        elif [ -n "${{ inputs.input }}" ]; then
          tooltrust scan --input "${{ inputs.input }}" --fail-on "${{ inputs.fail-on }}" $DEEP_SCAN_FLAG --output json --file "$REPORT_FILE" >/dev/null
        else
          echo "::error::Either 'server' or 'input' must be provided."
          exit 1
        fi
        
        SCAN_EXIT_CODE=$?
        
        # Turn behavior back on
        set -e
        
        if [ -f "$REPORT_FILE" ]; then
          GRADE=$(jq -r '.summary.avg_grade // empty' "$REPORT_FILE")
          SCORE=$(jq -r '.summary.avg_score // empty' "$REPORT_FILE")
          
          echo "grade=$GRADE" >> $GITHUB_OUTPUT
          echo "score=$SCORE" >> $GITHUB_OUTPUT
          
          # Multiline output for result
          echo "result<<EOF" >> $GITHUB_OUTPUT
          cat "$REPORT_FILE" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          
          # Print the report to stdout for Action logs
          cat "$REPORT_FILE"
        else
          echo "::warning::Scan report was not generated."
        fi
        
        exit $SCAN_EXIT_CODE