Security scanning in your terminal.
And your pipeline.

npm install -g scandar-scan

# Scan a skill file
scandar scan skill.md

# Scan an MCP server
scandar scan server.ts --type mcp

# Scan an MCP config
scandar scan .mcp.json

# Scan a directory (recursive)
scandar scan ./skills/

# JSON output for scripting
scandar scan skill.md --format json

# SARIF output for GitHub Code Scanning
scandar scan ./skills/ --format sarif > results.sarif

# Fail if trust score below threshold
scandar scan skill.md --threshold 70

# Fail on specific severity levels
scandar scan skill.md --fail-on critical,high

# Combine for strict gating
scandar scan ./src/ --threshold 80 --fail-on critical --format sarif

# Watch a directory — re-scan on every change
scandar watch ./skills/

# Watch with threshold
scandar watch ./skills/ --threshold 70 --quiet

# Layer 2 (LLM analysis) requires auth
scandar auth login      # Store API key
scandar auth status     # Check auth status
scandar auth logout     # Remove stored key

name: Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install -g scandar-scan
      - run: scandar scan ./skills/ --threshold 70 --fail-on critical
      - run: scandar scan ./skills/ --format sarif > results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
        if: always()

security-scan:
  image: node:20
  script:
    - npm install -g scandar-scan
    - scandar scan ./skills/ --threshold 70 --fail-on critical
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"