assay-cli 1.5.1

# Assay

[![Crates.io](https://img.shields.io/crates/v/assay-cli.svg)](https://crates.io/crates/assay-cli)
[![CI](https://github.com/Rul1an/assay/actions/workflows/release.yml/badge.svg)](https://github.com/Rul1an/assay/actions)
[![License](https://img.shields.io/crates/l/assay-core.svg)](https://github.com/Rul1an/assay/blob/main/LICENSE)

**Runtime security & linting for MCP servers.**
Finds vulnerabilities in your Model Context Protocol configuration and fixes them automatically.

## Install

### Script (Recommended)
```bash
curl -fsSL https://getassay.dev/install.sh | sh
```

### Cargo
```bash
cargo install assay-cli
```

## Quick Start

```bash
# 1. Scaffolding
assay init --pack default

# 2. Check for issues
assay validate

# 3. Autofix problems
assay fix --yes
```

## Core Features

-   **RCE Prevention**: Blocks `exec`, `shell`, `spawn`, `bash`, `powershell`.
-   **Path Containment**: Enforces file access strictly within `/app` and `/data`.
-   **Prompt Injection Defense**: Flags excessively long or vague tool descriptions.
-   **Atomic Autofix**: Safely repairs config/code with zero corruption risk (atomic I/O).

## CI: GitHub Actions (copy-paste)

Want Assay as a security gate in your PRs immediately? Create this file:

`.github/workflows/assay-security.yml`

```yaml
name: MCP Security (Assay)

on:
  push:
    paths:
      - "assay.yaml"
      - "policy.yaml"
      - "**/*.mcp.json"
  pull_request:
    paths:
      - "assay.yaml"
      - "policy.yaml"
      - "**/*.mcp.json"

jobs:
  security-check:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install Assay
        shell: bash
        run: |
          set -euo pipefail
          # Security: Download first to avoid pipe-to-shell
          curl -fsSL https://getassay.dev/install.sh -o install-assay.sh
          sh install-assay.sh
          rm install-assay.sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # Generate SARIF even if validate fails, so findings show up in GitHub Security.
      - name: Validate (SARIF)
        shell: bash
        run: |
          set -euo pipefail
          assay validate --format sarif --output results.sarif
        continue-on-error: true

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

      # Hard gate: fail the job if there are issues.
      - name: Validate (gate)
        shell: bash
        run: |
          set -euo pipefail
          assay validate --format text
```

### What you get
-   **Annotations in PRs** + Visibility in Security Tab → Code scanning alerts (via SARIF upload)
-   **Failing build** if there are policy/config issues

### Tip (Optional)
If your repo has multiple configs, you can explicitly pass a path:

```bash
assay validate --config path/to/assay.yaml --format sarif --output results.sarif
```

## Output Formats

-   **Human** (Default): ANSI-colored terminal output.
-   **JSON** (`--format json`): Strict schema for scripts/agents.
-   **SARIF** (`--format sarif`): Native GitHub Security tab integration.

## Configuration

Generated by `assay init`. Edit `assay.yaml` to customize:

```yaml
version: "1.0"
name: "mcp-default-gate"

# Global defaults
allow: ["*"]

# Explicit blocks
deny:
  - "exec*"
  - "shell*"

# Parametric constraints
constraints:
  - tool: "read_file"
    params:
      path:
        matches: "^/app/.*|^/data/.*"
```

## Documentation

Full documentation available at [getassay.dev](https://getassay.dev).

-   [Policy Packs](https://getassay.dev/docs/packs)
-   [CI Recipes](https://getassay.dev/docs/ci)
-   [Configuration Reference](https://getassay.dev/docs/config)

## Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

```bash
cargo test --workspace
```

## License

[MIT](LICENSE)