This repository is a live GitHub Actions demo for IntentProbe.
It shows the product behavior without a video:
- a normal MCP-style skill passes the gate;
- a poisoned skill that tries to read private keys and send them out gets blocked before merge;
- the scanner runs inside GitHub Actions with no scan content uploaded to an IntentProbe server.
The workflow is in .github/workflows/intentprobe.yml.
Live proof:
- Main branch safe scan: https://github.com/mcpware/intentprobe-demo/actions/runs/27187158894
- Safe PR passes: #1
- Poisoned PR is blocked: #2
It runs:
- uses: mcpware/IntentProbe@main
with:
paths: |
skills
fail-on: block
hf-token: ${{ secrets.HF_TOKEN }}The scanner verdict is machine-readable and can be used as an install-time or CI admission gate for MCP servers, agent tools, and skills.