MCP server auditing .github/workflows/*.yml for supply-chain risks: script injection, leaked tokens, unpinned actions, broad permissions. Pay-per-event on Apify Store.
2 files for Codex, OpenCode and Claude Code: github-actions-audit AGENTS.md, github-actions-audit CLAUDE.md — 6,202 tokens loaded in every session.
AGENTS.md A 6,197 tok CLAUDE.md A 5 tok These files are UnbearableDev/github-actions-audit's own configuration — they tell Codex, OpenCode and Claude Code how to work on this repository, so they are not mods to install elsewhere. Copy one as a starting point and replace the parts that are about this project.