# Marketplace name: the bare 'mcp-scan' slug 500s on publish, consistent with a
# collision against a delisted listing of the same name (Invariant Labs' Action,
# pre-Snyk-rename). Slugs of removed listings stay reserved; GitHub surfaces the
# collision as a server error rather than a validation message.
name: 'mcp-scan Action'
description: 'Security scanner for MCP server configurations'
author: 'ThynkQ'
branding:
  icon: 'shield'
  color: 'blue'
inputs:
  config:
    description: 'Path to specific MCP config file'
    required: false
    default: ''
  severity:
    description: 'Minimum severity threshold (critical|high|medium|low|info)'
    required: false
    default: 'high'
  fail-on-findings:
    description: 'Exit with code 1 if findings exist at or above threshold'
    required: false
    default: 'true'
  sarif-output:
    description: 'Path for SARIF report output'
    required: false
    default: 'mcp-scan-results.sarif'
outputs:
  findings-count:
    description: 'Total findings'
  critical-count:
    description: 'Critical findings'
  high-count:
    description: 'High severity findings'
  medium-count:
    description: 'Medium severity findings'
  low-count:
    description: 'Low severity findings'
  info-count:
    description: 'Info findings'
  sarif-path:
    description: 'Path to SARIF file'
runs:
  using: 'node24'
  main: 'action/dist/action.cjs'