{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreicesu5v3ll2mxsl6xqf3fhghzkhsa4h3oxh7gm2upe2a2oirluje4",
    "uri": "at://did:plc:25rdn5elo5izoxrmtis34zuk/app.bsky.feed.post/3momtosuvn7s2"
  },
  "coverImage": {
    "$type": "blob",
    "ref": {
      "$link": "bafkreiee7fkwuji57p5ldjkixayylnm3xi27ujtw5dkhx4eqyijws3snpi"
    },
    "mimeType": "image/webp",
    "size": 67806
  },
  "path": "/asterworks/i-published-my-first-github-marketplace-action-aster-guard-mcp-1d74",
  "publishedAt": "2026-06-19T07:14:19.000Z",
  "site": "https://dev.to",
  "tags": [
    "mcp",
    "security",
    "githubactions",
    "claude",
    "https://github.com/marketplace/actions/aster-guard-mcp",
    "https://github.com/Aster-Works/aster-guard",
    "https://www.npmjs.com/package/@asterworks/aster-guard",
    "@asterworks"
  ],
  "textContent": "I just published my first GitHub Marketplace Action: **Aster Guard MCP**.\n\nMarketplace:\nhttps://github.com/marketplace/actions/aster-guard-mcp\n\nRepository:\nhttps://github.com/Aster-Works/aster-guard\n\nIt is a lightweight, local-first security scanner for MCP and Claude Code configuration files.\n\nThe goal is intentionally small:\n\n> Before connecting an MCP server to your AI coding environment, check whether the configuration looks safe enough to trust.\n\n##  Why I built it\n\nMCP is becoming a very practical way to connect AI coding tools to real developer systems.\n\nDepending on the MCP server, an AI agent may gain access to:\n\n  * local files\n  * shell commands\n  * browsers\n  * databases\n  * SaaS APIs\n  * internal developer tools\n\n\n\nThat is powerful. It is also a meaningful security boundary.\n\nFor example, a single `.mcp.json` entry can define a command to run, expose environment variables, grant filesystem access, or connect to a remote endpoint. Tool descriptions can also contain hidden instructions that shape how an agent behaves.\n\nSo I wanted a small check that runs before that connection happens.\n\n##  What Aster Guard MCP does\n\nAster Guard statically scans MCP and Claude Code configuration files.\n\nThe important part is what it does **not** do:\n\n  * it does not start the MCP servers it scans\n  * it does not execute scanned commands\n  * it does not send telemetry\n  * it does not call external APIs during normal scans\n  * it redacts secrets in output\n\n\n\nIt looks for risk patterns such as:\n\n  * hidden agent instructions in tool descriptions\n  * hardcoded secrets\n  * sensitive file paths such as `.ssh`, cloud credentials, and `.env`\n  * shell execution and dangerous install commands\n  * destructive commands\n  * overbroad filesystem access\n  * unknown remote MCP endpoints\n  * tool-name shadowing\n  * obfuscated command patterns\n\n\n\nThe output includes a risk score, a grade, findings, and recommended next steps in English and Japanese.\n\n##  Try it locally\n\nYou can run it without installing anything globally:\n\n\n\n    npx -y @asterworks/aster-guard scan\n\n\nOr scan a specific config file:\n\n\n\n    npx -y @asterworks/aster-guard scan .mcp.json\n\n\n##  Use it in GitHub Actions\n\nNow that it is on GitHub Marketplace, you can add it to a workflow:\n\n\n\n    - uses: Aster-Works/aster-guard@v0.3.2\n      with:\n        path: .\n        fail-on: high\n\n\nYou can also produce SARIF and upload the result to GitHub code scanning:\n\n\n\n    - uses: Aster-Works/aster-guard@v0.3.2\n      with:\n        path: .\n        fail-on: high\n        sarif: results.sarif\n\n    - uses: github/codeql-action/upload-sarif@v3\n      if: always()\n      with:\n        sarif_file: results.sarif\n\n\n##  Where it fits\n\nAster Guard is not trying to be a full security platform.\n\nIt is not a runtime firewall, antivirus tool, SIEM, or complete supply-chain scanner. It is a narrow pre-connection check for MCP configuration risk.\n\nThat narrow scope is deliberate. I wanted something that individual developers and small teams can run quickly before trusting an unfamiliar MCP server.\n\n##  What I would love feedback on\n\nThis is still early, so the most useful feedback is practical:\n\n  * Are the findings easy to understand?\n  * Does the report help you decide what to do next?\n  * Are there common MCP configuration risks it should detect?\n  * Would this be useful in CI, or mainly as a local pre-check?\n\n\n\nIf you are experimenting with MCP or Claude Code, I would love for you to try it on a real configuration and open an issue with anything confusing, noisy, or missing.\n\nLinks:\n\n  * GitHub Marketplace: https://github.com/marketplace/actions/aster-guard-mcp\n  * GitHub repository: https://github.com/Aster-Works/aster-guard\n  * npm: https://www.npmjs.com/package/@asterworks/aster-guard\n\n",
  "title": "I published my first GitHub Marketplace Action: Aster Guard MCP"
}