Ci Investigator Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Ci Investigator Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Published MCP server for investigating GitHub Actions CI failures.
This package exposes tools to:
List recent failed workflow runs for a repository.
Input:
owner (string, required): repo owner or orgrepo (string, required): repo namelimit (number, optional, default: 10, min: 1, max: 100)Returns:
Fetch and summarize a failed run.
Input:
owner (string, required)repo (string, required)run_id (number, required): failed workflow run idReturns:
Notes:
Compare a failed run with the previous successful run on the same branch.
Input:
owner (string, required)repo (string, required)run_id (number, required): failed workflow run idReturns:
null)commit_changedauthor_changedevent_changedcommits_between (GitHub compare URL or fallback text)Detect flaky jobs by analyzing recent completed runs on a branch.
Input:
owner (string, required)repo (string, required)branch (string, required)limit (number, optional, default: 30, min: 1, max: 100)Returns:
Classify likely failure cause based on logs and fallback data.
Input:
owner (string, required)repo (string, required)run_id (number, required)Returns:
test_regression, infra_network, dependency, timeout, lint_or_type, auth_permissions, unknown)Suggest practical remediation and validation steps for a failed run.
Input:
owner (string, required)repo (string, required)run_id (number, required)Returns:
Summarize recurring failed jobs over a configurable time window.
Input:
owner (string, required)repo (string, required)days (number, optional, default: 14)branch (string, optional)limit (number, optional, default: 100)Returns:
Find likely regression commit and linked PR for a failed run.
Input:
owner (string, required)repo (string, required)run_id (number, required)Returns:
Compute CI health score for a branch using pass/fail and flaky-job signals.
Input:
owner (string, required)repo (string, required)branch (string, required)days (number, optional, default: 14)limit (number, optional, default: 100)Returns:
Build deduplicated digest of recent failures for alerting/triage workflows.
Input:
owner (string, required)repo (string, required)interval_hours (number, optional, default: 24)branch (string, optional)limit (number, optional, default: 20)Returns:
Recommended token permissions:
actions:readchecks:readcontents:readRunning a server on its own is less useful than wiring it into an MCP client.
Set GITHUB_TOKEN in your client config:
{
"servers": {
"ci-investigator": {
"command": "npx",
"args": ["-y", "ci-investigator-mcp"],
"env": {
"GITHUB_TOKEN": "ghp_your_token"
}
}
}
}On Windows, wrap npx with cmd /c:
{
"servers": {
"ci-investigator": {
"command": "cmd",
"args": ["/c", "npx", "-y", "ci-investigator-mcp"],
"env": {
"GITHUB_TOKEN": "ghp_your_token"
}
}
}
}401 or 403 errors: verify GITHUB_TOKEN and permissions.run_id, owner, and repo are correct.node or npxSome IDEs (VS Code, Cursor) launch with a limited PATH and can't find Node.js installed via nvm or similar version managers.
Run the following to find the full paths:
which node && which npxThen use the full path in your MCP config:
{
"servers": {
"ci-investigator": {
"command": "/Users/your-user/.nvm/versions/node/v22.14.0/bin/npx",
"args": ["-y", "ci-investigator-mcp"],
"env": {
"GITHUB_TOKEN": "your_token",
"PATH": "/Users/your-user/.nvm/versions/node/v22.14.0/bin:/usr/local/bin:/usr/bin:/bin"
}
}
}
}ISC
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.