Skip to content

docs: link the GitHub Marketplace listing + document the action in the install section #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RubenSousaDinis merged 1 commit into from
Jun 26, 2026
Merged

docs: link the GitHub Marketplace listing + document the action in the install section #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@ Fail a build when an MCP **server** or an Agent **Skill** it ships grades **D/F*
behavioral litmus. For servers it is hybrid — a fast lookup of the published grade, then the harness
when ungraded; for skills it is a fast static scan. Un-gradeable targets warn unless `strict`.

It's on the **[GitHub Marketplace](https://github.com/marketplace/actions/polygraph-mcp-gate)** as
`polygraphso/litmus@v1` — drop it into a workflow:

```yaml
# .github/workflows/mcp-gate.yml
name: mcp-gate
Expand Down
33 changes: 33 additions & 0 deletions packages/litmus/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,39 @@ npx -y -p @polygraphso/litmus polygraphso-litmus litmus npm/@modelcontextprotoco
Requires Node ≥ 18. **Docker is optional** — without it, C-02 (egress) is skipped
and the grade is capped at **B** for that run.

### Gate your CI (GitHub Action)

Fail a build when an MCP **server** — or an Agent **Skill** it ships — grades **D/F**.
The [**polygraph MCP gate**](https://github.com/marketplace/actions/polygraph-mcp-gate)
on the GitHub Marketplace wraps the harness as `polygraphso/litmus@v1`:

```yaml
# .github/workflows/mcp-gate.yml
name: mcp-gate
on: [pull_request]
permissions:
contents: read
jobs:
gate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: polygraphso/litmus@v1
with:
# Auto-discovers MCP servers (.mcp.json / .vscode/mcp.json / .cursor/mcp.json)
# and skills (SKILL.md dirs). Or name them explicitly:
servers: |
npm/@modelcontextprotocol/server-filesystem
# min-grade: B # stricter than the default D/F gate
# strict: "true" # also fail on targets that cannot be graded
```

Inputs: `servers` · `skills` · `discover` (default `true`) · `min-grade` · `strict` ·
`working-directory` · `version` · `bearer`. Outputs: `result` · `failed` · `report`.
Not on GitHub? The gate is a plain command —
`npx -y -p @polygraphso/litmus polygraphso-litmus ci` — so it runs in any CI or as a
pre-commit hook.

## CLI

```bash
Expand Down
Loading