Sentinel Scan v1.4.8 - GitHub Action ready for Marketplace

GitHub Action for CI: scan MCP manifests on push/PR and fail the build on high-severity findings, in one step.

- uses: actions/checkout@v4
- uses: Ventrova/sentinel-scan-cli@v1
  with:
    manifest: mcp.json
    fail-on-severity: high

Full inputs/outputs reference and SARIF/markdown/json output modes in the README's GitHub Action section.

Since v1.4.2: adds the sentinel-scan evidence subcommand (Annex IV evidence pack, #2), CLI output CTAs, and various instrumentation/version-string fixes. Same 15-attack corpus + MCP manifest heuristics, no network calls, no secrets required.

Install: npx sentinel-scan-cli / pip install sentinel-scan-cli / uses: Ventrova/sentinel-scan-cli@v1.

Sentinel Scan v1.4.2

Marketplace listing fix: shortened the GitHub Action description to under 125 chars so Ventrova/sentinel-scan-cli can be published to the GitHub Marketplace. No change to the scanner or action behavior; same 15-attack corpus + MCP manifest heuristics as v1.4.1. Install: npx sentinel-scan-cli / pip install sentinel-scan-cli / uses: Ventrova/sentinel-scan-cli@v1.4.2.

v1.4.1

Added

• -v/--version flag on both entrypoints (Node reads package.json, Python gets a __version__ constant + argparse version action). npx sentinel-scan-cli --version previously errored with "unrecognized argument: --version".

Fixed

• Python's scan-output VERSION constant synced to 1.4.1 for byte-for-byte output parity with the Node port (both now emit "version":"1.4.1").
• npm publishing switched to tokenless Trusted Publishing (OIDC), dropping the NPM_TOKEN/granular-token 2FA-bypass dependency ahead of its GitHub-side deprecation.

Also since v1.4.0

• README updated to reflect sentinel-scan-cli being live on npm (npx sentinel-scan-cli / npm i -g sentinel-scan-cli work directly, no github: install prefix needed).
• --fail-on CI exit-code gating added to both sentinel-scan and sentinel-scan mcp for bare-CLI users running their own CI, independent of the GitHub Action.

v1.4.0

Added

• sentinel-scan mcp --format sarif on both the Python (sentinel_scan.py) and Node (bin/sentinel-scan.js) builds, emitting a SARIF 2.1.0 log for GitHub code scanning / CI SARIF consumers.
• Rule metadata (id, description) reuses the existing OWASP LLM/MCP Top 10 mapping so both JSON and SARIF output cite the same categories.
• File/line locations recovered where the flagged tool name appears verbatim in the manifest source.
• HIGH/MEDIUM/LOW severities map to the standard SARIF error/warning/note levels.
• Fixture-based tests (tests/test_mcp_sarif.py, tests/test_mcp_sarif.test.js) validating SARIF structure and expected rule IDs on the known-malicious fixture, for both builds.

This is the CLI-side prerequisite for the GitHub Action's native SARIF output path.

v1.3.0 - MCP permission/secrets misconfig ruleset

sentinel-scan mcp: permission/secrets misconfig heuristics

Extends the zero-network, zero-dependency `sentinel-scan mcp` static scanner with four additional heuristic classes, all dual-tagged against OWASP LLM Top 10 and OWASP MCP Top 10 (beta):

• unpinned_remote_source (LLM03 / MCP04): flags `mcpServers` entries that launch a package via npx/uvx/pip/etc with no pinned version, or that use a plaintext `http://` remote transport
• hardcoded_credential (LLM02 / MCP03): flags literal API keys/tokens/passwords embedded in a server's `env` block or CLI args instead of an `${ENV_VAR}` placeholder
• overbroad_tool_scope (LLM06 / MCP06): flags wildcard/blanket scope or permission strings (`"*"`, `"all"`, `"admin"`) instead of an enumerated least-privilege list
• missing_provenance (LLM03 / MCP04): flags a remote-sourced server entry with no signature/checksum/publisher field to verify what's actually being launched

Also included since v1.1.0:

• `missing_hitl_confirmation` and `hidden_unicode_instructions` heuristics
• OWASP MCP Top 10 (beta) dual-tagging alongside the existing LLM Top 10 tags on every finding
• 40-fixture benchmark corpus (`fixtures/benchmark/`) with per-technique severity labels for cross-scanner comparison

This is a static config lint against the manifest text/schema only - it does not execute the MCP server or call an LLM. Full technique table and heuristic-by-heuristic docs: see README.md.

```bash
pip install git+https://github.com/Ventrova/sentinel-scan-cli
sentinel-scan mcp --demo
```

Note: the PyPI and npm packages are still a few releases behind `master` (missing the `mcp` subcommand entirely on the npm side) - install from GitHub for the latest.

v1.1.0 - GitHub Action: SARIF upload + Marketplace polish

What's new since v1.0.0

• Automatic SARIF upload to code scanning. New upload-sarif input
  (default true): when format is sarif, the action now runs
  github/codeql-action/upload-sarif itself, so findings show up as native
  annotations on the repo's Security tab and PR diffs with no extra step.
  Requires the calling job to grant security-events: write. Set
  upload-sarif: 'false' to opt out and handle the upload yourself.
• Marketplace-ready polish. Composite action branding (shield icon, red),
  a full inputs/outputs reference table in the README, a runnable usage
  snippet for reading finding-count/results-file in a later step, and
  CI/release/license status badges.
• CI fix. The self-test workflow's SARIF-upload step was failing in this
  repo's own CI because the default GITHUB_TOKEN doesn't carry
  security-events: write here; the self-test now runs with
  upload-sarif: 'false' (documented inline) so it stays green and
  fork-PR-safe, while the README shows real consumers how to grant that
  permission in their own workflows.

Usage

name: MCP security scan
on: [pull_request]

permissions:
  contents: read
  security-events: write   # required for the SARIF upload to code scanning

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Ventrova/sentinel-scan-cli@v1
        with:
          manifest: mcp.json          # path to your MCP tool manifest
          fail-on-severity: high      # high | medium | low | none
          format: sarif               # sarif | markdown | json
          output: sentinel-scan-results.sarif
          upload-sarif: 'true'        # auto-upload to the Security tab when format is sarif

Inputs

Input	Default	Description
manifest	mcp.json	Path to the MCP tool manifest to scan
fail-on-severity	high	Fail the step at this severity or above: high, medium, low, none
format	sarif	Report format: sarif, markdown, or json
output	sentinel-scan-results.sarif	Where to write the report
upload-sarif	true	Auto-upload SARIF to code scanning when format is sarif

Outputs

Output	Description
results-file	Path to the generated report file
finding-count	Total number of findings

No PyPI/npm publish dependency - the action installs the Python package
straight from this repo's own checkout at ${{ github.action_path }}, no
network calls beyond installing actions/setup-python.

Full diff: v1.0.0...v1.1.0

v1.0.0 - GitHub Action

First release of the sentinel-scan-cli GitHub Action.

Wraps sentinel-scan mcp for CI: scans an MCP tool manifest for
prompt-injection, excessive-agency, and other OWASP LLM Top 10 risks,
then fails the build on a configurable severity threshold.

Usage:

- uses: Ventrova/sentinel-scan-cli@v1
  with:
    manifest: mcp.json
    fail-on-severity: high
    format: sarif
    output: sentinel-scan-results.sarif

Inputs: manifest, fail-on-severity (high/medium/low/none), format
(sarif/markdown/json), output. Outputs: results-file, finding-count.

No PyPI/npm publish dependency - the action installs the Python package
straight from this repo's own checkout at ${{ github.action_path }}.

The v1 tag tracks the latest v1.x.x release, per GitHub's recommended
Action versioning convention.