scan.yml

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync

      - name: Build bundle
        run: npx @anthropic-ai/mcpb pack

      - name: Run MTF scanner
        run: uvx mpak-scanner scan *.mcpb --json > scan-results.json

      - name: Check for critical/high findings
        run: |
          python3 -c "
          import json, sys
          with open('scan-results.json') as f:
              results = json.load(f)
          findings = results.get('findings', [])
          critical_high = [f for f in findings if f.get('severity') in ('CRITICAL', 'HIGH')]
          if critical_high:
              print(f'FAIL: {len(critical_high)} critical/high findings')
              for f in critical_high:
                  print(f'  [{f[\"severity\"]}] {f.get(\"control\", \"\")} - {f.get(\"message\", \"\")}')
              sys.exit(1)
          print(f'PASS: No critical/high findings ({len(findings)} total findings)')
          "