Catch MCP Tool-Poisoning and Prompt-Injection Regressions on Every PR (GitHub Actions + pre-commit)

A detailed walkthrough demonstrates how to integrate two security scans into GitHub Actions and pre-commit to detect potential issues before they reach production. The sentinel-scan-cli, a free, zero-dependency tool, offers two functionalities: a prompt-injection suite against LLM endpoints and a static scanner for tool poisoning and excessive agency. Both scans are mapped to the OWASP LLM Top 10 (2025) security standards.

The author provides real output from running the scans against the CLI's built-in mock target and a vulnerable manifest. The prompt-injection demo reveals three vulnerabilities: story_injection, prompt_leak_direct, and markdown_exfil, all of which passed the system prompt. The MCP scan against the vulnerable manifest uncovered 18 findings, including HIGH-severity issues such as prompt injection on search_docs, excessive agency on run_diagnostics, hardcoded_credential on github-tools, and more.

However, a crucial gap was identified: neither scan fails its exit code on findings. This means that even if a scan finds significant issues, it will not halt the CI process. To address this, the author created a wrapper script called gate.py. This script reads the JSON output from the scans and fails the CI process if the severity threshold is exceeded.

By running this script after the scans, developers can ensure that their code is thoroughly checked for security vulnerabilities before being merged into the main branch. The script works by parsing the JSON summary block and exiting with a non-zero status if the scan crosses the specified severity threshold.