assay-cli-1.5.1 is not a library.

Assay

Runtime security & linting for MCP servers. Finds vulnerabilities in your Model Context Protocol configuration and fixes them automatically.

Install

Script (Recommended)

curl -fsSL https://getassay.dev/install.sh | sh

Cargo

cargo install assay-cli

Quick Start

# 1. Scaffolding
assay init --pack default

# 2. Check for issues
assay validate

# 3. Autofix problems
assay fix --yes

Core Features

RCE Prevention: Blocks exec, shell, spawn, bash, powershell.
Path Containment: Enforces file access strictly within /app and /data.
Prompt Injection Defense: Flags excessively long or vague tool descriptions.
Atomic Autofix: Safely repairs config/code with zero corruption risk (atomic I/O).

CI: GitHub Actions (copy-paste)

Want Assay as a security gate in your PRs immediately? Create this file:

.github/workflows/assay-security.yml

name: MCP Security (Assay)

on:
  push:
    paths:
      - "assay.yaml"
      - "policy.yaml"
      - "**/*.mcp.json"
  pull_request:
    paths:
      - "assay.yaml"
      - "policy.yaml"
      - "**/*.mcp.json"

jobs:
  security-check:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install Assay
        shell: bash
        run: |
          set -euo pipefail
          # Security: Download first to avoid pipe-to-shell
          curl -fsSL https://getassay.dev/install.sh -o install-assay.sh
          sh install-assay.sh
          rm install-assay.sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # Generate SARIF even if validate fails, so findings show up in GitHub Security.
      - name: Validate (SARIF)
        shell: bash
        run: |
          set -euo pipefail
          assay validate --format sarif --output results.sarif
        continue-on-error: true

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

      # Hard gate: fail the job if there are issues.
      - name: Validate (gate)
        shell: bash
        run: |
          set -euo pipefail
          assay validate --format text

What you get

Annotations in PRs + Visibility in Security Tab → Code scanning alerts (via SARIF upload)
Failing build if there are policy/config issues

Tip (Optional)

If your repo has multiple configs, you can explicitly pass a path:

assay validate --config path/to/assay.yaml --format sarif --output results.sarif

Output Formats

Human (Default): ANSI-colored terminal output.
JSON (--format json): Strict schema for scripts/agents.
SARIF (--format sarif): Native GitHub Security tab integration.

Configuration

Generated by assay init. Edit assay.yaml to customize:

version: "1.0"
name: "mcp-default-gate"

# Global defaults
allow: ["*"]

# Explicit blocks
deny:
  - "exec*"
  - "shell*"

# Parametric constraints
constraints:
  - tool: "read_file"
    params:
      path:
        matches: "^/app/.*|^/data/.*"

Documentation

Full documentation available at getassay.dev.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

cargo test --workspace

License

MIT

assay-cli 1.5.1