Actionstep Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Actionstep Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Actionstep — 144 tools covering the full Actionstep REST API for law firm practice management. Use Actionstep from Claude Desktop with natural language.
Actionstep developer access: Register at the Actionstep developer portal to obtain OAuth credentials.
pip install actionstep-mcpactionstep-mcp-setupThis opens a browser for OAuth authorization and saves credentials to ~/.actionstep-mcp/.
Verify:
actionstep-mcp-verify{
"mcpServers": {
"actionstep": {
"command": "actionstep-mcp"
}
}
}By default credentials are stored in your operating system's native secret store via the cross-platform keyring library:
| OS | Backend |
|---|---|
| macOS | Keychain |
| Windows | Credential Manager |
| Linux | Secret Service (GNOME Keyring / KWallet) |
Secrets are saved under the service name actionstep-mcp. Nothing is written to disk in clear text.
File fallback. On a host with no keyring backend (e.g. a headless Linux box without Secret Service), or if you set ACTIONSTEP_MCP_USE_KEYRING=0, credentials fall back to a ~/.actionstep-mcp/.env file with 0600 permissions.
Read order. Credentials resolve in the order OS keyring → process environment → .env file. So a rotated secret in the keyring always wins, and an ACTIONSTEP_CLIENT_ID / ACTIONSTEP_CLIENT_SECRET exported in your shell overrides the file fallback without touching the keyring.
Actionstep uses a dynamic api_endpoint — the URL for your organisation's API is returned in the OAuth token response and varies per firm. The setup wizard captures and stores this automatically.
"List my open actions"
>
"Create a task on action 456 — send retainer agreement to client"
>
"Log 2.5 hours on action 789, description: drafted statement of claim"
>
"Add a file note on action 123 — client called re: mediation date"
>
"Create a calendar appointment for the Jones hearing on Monday 10am"
MIT
<!-- ci-trigger 2026-05-27 -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.