Merge pull request #3 from NimbleBrainInc/add-test-layers #13

	name: Security Scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	scan:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Install uv
	uses: astral-sh/setup-uv@v4
	with:
	version: "latest"

	- name: Set up Python
	run: uv python install 3.13

	- name: Install dependencies
	run: uv sync

	- name: Build bundle
	run: npx @anthropic-ai/mcpb pack

	- name: Run MTF scanner
	run: \|
	if pip install mpak-scanner 2>/dev/null; then
	mpak-scanner scan *.mcpb --json > scan-results.json
	else
	echo "mpak-scanner not yet available — skipping client-side scan"
	echo '{"findings": []}' > scan-results.json
	fi

	- name: Check for critical/high findings
	run: \|
	python3 -c "
	import json, sys
	with open('scan-results.json') as f:
	results = json.load(f)
	findings = results.get('findings', [])
	critical_high = [f for f in findings if f.get('severity') in ('CRITICAL', 'HIGH')]
	if critical_high:
	print(f'FAIL: {len(critical_high)} critical/high findings')
	for f in critical_high:
	print(f' [{f[\"severity\"]}] {f.get(\"control\", \"\")} - {f.get(\"message\", \"\")}')
	sys.exit(1)
	print(f'PASS: No critical/high findings ({len(findings)} total findings)')
	"

Provide feedback