MCP Security CI

An MCP security CI gate is a preflight, not a certification: a read-only check that fails your build when a registered MCP endpoint stops completing a clean handshake. The need is measurable. In our weekly scans, 115 endpoints that passed one week flipped to UNKNOWN the next (2.4% weekly churn), and 43 servers in the registry fail outright. The mcp-trust-check GitHub Action below runs mcpreflight on every pull request, with no API keys and no tool invocation. Numbers: State of MCP Servers, October 2026.

Use the read-only GitHub Action in pull requests:

- uses: xka0085-byte/mcpreflight@v1
  with:
    endpoint: https://your-mcp.example/mcp
    mode: schema
    format: markdown

See the full CI guide. This is not a security certification and does not call tools or use credentials.

Back to mcpreflight