eulogik/opentrustbench-action

OpenTrustBench CI Scanner — GitHub Action for AI agent and MCP server trust scanning (SARIF, A–F grades)

About opentrustbench-action

Scan AI agents, skills, and MCP tool servers in CI. Graded Trust Cards (A–F), 8 OWASP-mapped rules, SARIF upload to GitHub Code Scanning.

Mirror note: this repo mirrors packages/action/action.yml from eulogik/OpenTrustBench. It exists as a standalone repo because GitHub Marketplace requires action.yml at the repository root. Edit upstream, then copy here.

With SARIF upload to Code Scanning (requires security-events: write):

Input Default Description ----------------------------- target . Path or directory to scan format sarif Report format: sarif, json, md, terminal output-dir . Directory where reports are written fail-on high Minimum severity that fails CI: info/low/medium/high/critical

Reports: trust-card.json + opentrustbench-report.sarif (or .json/.md) in output-dir.

- Site + registry: https://www.opentrustbench.com - Upstream source: https://github.com/eulogik/OpenTrustBench - License: Apache-2.0

From the project README.

Maintaining this server?

Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:

[![On MCP Radar](https://mcp.liqiwa.com/badge.svg)](https://mcp.liqiwa.com/s/eulogik--opentrustbench-action.html)