TaskBounty Check

2. Agent / MCP— a local stdio server for Cursor, Claude Code, and Codex:

3. One-off CLI— scan the current repo locally and write a report:

Pin a version (@0.1.6) in committed config and CI for reproducibility.@latestis convenient for a quick one-off, but a pinned version is the reproducible choice.

The Action writes a counts-only maintenance summary to the workflow run (categories and next steps, no filenames, line numbers, or repo source). Below is that exact summary, rendered from this repo's own CI output:

Supported checks (and honest limitations)

Checks (GitHub Actions + CI maintenance hygiene):

- Third-party actions pinned to a movable tag/branch instead of a commit SHA
- Broad (write-all) workflow token permissions
- Missing explicitpermissions:block
- Update automation (Dependabot/Renovate) presence
- Context-dependent workflow patterns flagged for private review (e.g.pull_request_target, script injection)

Does NOT check(these need a manual review): exposed secrets, auth/authorization, payments, webhooks, runtime behavior. It is a maintenance/hygiene check,nota full security audit or a penetration test.

- Reads only your GitHub Actions workflow files and update-automation config, scans them in-process with a deterministic ruleset (the same rules as the public checker), and writes a local HTML + JSON report. It doesnotexecute workflows, install dependencies, or run any repository code.

--gh-orguses your existingghCLI session to fetch each repo's workflow filesto this machine(read-only). Your GitHub token is never read by this tool and never sent to TaskBounty.

Run--explain-datato print this at any time.

- Reads (allowlist — nothing else is opened):<repo>/.github/workflows/.yml|.yamland update-automation config (dependabot.yml/renovate.json). Never source files,.env, secrets, SSH keys, credential stores, or anything outside the selected repository roots. Symlinks that escape a root are skipped, never followed.
- Writes (local only):<out>.json(full detail) and<out>.html.
- Transmits:nothing by default.--shareuploads nothing— it writes asanitized, counts-only*file (scan id, label, candidate counts by category, private-reviewcount, scanner version, timestamps; repo names only with--include-repo-names) for you to submitmanually. Network stays off under--share. Only--gh-orgintentionally uses the network.

--share·--gh-org <org>·--manifest <file>·--org-label <label>·--include-repo-names·--dry-run·--explain-data·--delete-local-report·--no-network(default everywhere except--gh-org) ·--out <basename>·--version·--help

Want help interpreting or fixing these results?

TaskBounty receives nothing unless you submit that form.The scan runs locally and the full report stays on your machine; the review form gives us no access to your repositories, source, workflows, or secrets.

Emit SARIF 2.1.0 and surface findings in your repo's Security → Code scanning tab:

npx taskbounty-check@latest . --format sarif --output taskbounty.sarif

The SARIF carries deterministic rule ids (taskbounty/<rule>), severity levels, and file/line references —no source contents, secrets, or environment values, and no network access. Confirmed findings are emitted askind: fail; lower-confidence items askind: review.

permissions: contents: read security-events: write steps: - uses: actions/checkout@v4 - run: npx taskbounty-check@0.1.6 . --format sarif --output taskbounty.sarif - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: taskbounty.sarif

Run alocalstdio MCP server so Codex, Claude Code, or Cursor can scan and reason about findings in your editor. It runs locally, makeszero outbound network requests, uploads no source, andnever modifies files—generate_fix_planreturns a plan as text for you to apply yourself.

Tools:scan_repo(local scan summary),explain_finding(plain-language explanation),generate_fix_plan(text fix plan).

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

An MCP Server for the GitHub Actions API, enabling AI assistants to manage and operate GitHub Actions workflows.

Interact with GitHub APIs for automation and repository management.

Integrates with GitHub APIs for advanced automation and interaction, supporting both remote and local deployments.

Integrate with GitHub APIs for automation and interaction.

Seamlessly integrate with GitHub APIs for development automation and interaction.

Seamlessly integrate with GitHub APIs for development automation and interaction.

All Azure MCP tools in a single server. The Azure MCP Server implements the MCP specification to create a seamless connection between AI agents and Azure services. Azure MCP Server can be used alone or with the GitHub Copilot for Azure extension in VS Code.

Flag features, manage company data, and control feature access using Bucket.