Teams and CI · mcp-audit Academy

One person can run commands. A team needs checks that run on their own. The usual setup has three layers:

On your laptopPre-commit hook

Blocks a commit that adds a HIGH finding, like a pasted key.

On every PRGitHub Action + lock

Scans, posts to the Security tab, fails on drift from mcp-lock.json.

For the teamPolicy file

Approved servers, minimum score, allowed transports.

.github/workflows/mcp-audit.yml

name: MCP Security Scan
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
jobs:
  mcp-audit:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Run mcp-audit
        uses: adudley78/mcp-audit@v0.26.0
        with:
          version: v0.26.0
          severity-threshold: high
          upload-sarif: 'true'

.pre-commit-config.yaml

repos:
  - repo: https://github.com/adudley78/mcp-audit
    rev: v0.26.0
    hooks:
      - id: mcp-audit

Adoption tipStart with severity-threshold: high so the build only fails on serious issues. Tighten to medium once you've cleared the backlog.

GitHub Action

Team & CI

uses: adudley78/mcp-audit@v0.26.0

What: Runs mcp-audit on every push and pull request and posts findings to the GitHub Security tab.
Why it matters: Every change to an MCP config is checked automatically before it merges.

Docs: github-action.md

Pre-commit hook

Team & CI

pre-commit: id mcp-audit

What: Blocks a commit when a staged JSON config has HIGH or worse findings.
Why it matters: Stops a pasted API key from ever reaching the repository.

Docs: pre-commit.md

MCP-aware diff

Team & CI

mcp-audit diff HEAD~1 HEAD

What: Shows what changed between two versions of your MCP setup: servers added or removed, new capabilities, new endpoints, new secrets, each with a risk level.
Why it matters: Reviewers see the security meaning of a config change, not just changed JSON lines.

Docs: diff.md

Governance policy

Team & CI

mcp-audit policy init

What: A YAML file of your organization's rules: which servers are approved, minimum score, allowed transports, findings you won't accept.
Why it matters: Your team's standard is written down and checked on every scan.

Docs: governance.md

Custom detection rules

Team & CI

mcp-audit rule validate my-rule.yml

What: Write your own checks in YAML. 35 community rules already run on every scan.
Why it matters: Encode the thing your team keeps getting wrong, once.

Docs: writing-rules.md

Check yourself

1. Which permission does the Action need to upload SARIF?

2. A good first severity threshold for a team adopting mcp-audit?

3. What's the difference between rules and policy?