zanadir — Claude Code MCP server: what it does, how to install
Reads a repo's CI configuration and reports which security checks are absent, plus which present ones can never fail a build.
claude mcp add --env GITHUB_TOKEN=<GITHUB_TOKEN> --transport stdio zanadir -- docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0What zanadir does
It covers six CI systems: GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Azure Pipelines and Jenkins. You point it at a local checkout or at a GitHub repo it reads without cloning. Twelve control categories — dependency scanning, secret detection, SBOMs, workflow hardening and the rest — get matched against the tools that supply them, and suggested fixes follow the repo's languages.
Presence is not the whole story. A scanner sitting behind continue-on-error, --exit-code 0, || true or allow_failure shows up in the file yet cannot block a merge. zanadir labels each control enforcing, partial, advisory or unknown. Pass --required-checks and a control counts as enforcing only when branch protection or a ruleset demands it.
The MCP mode exposes two read-only tools. scan hands back a JSON report; fix returns config snippets for the gaps and writes nothing. Both accept dir or repo, plus excludedCategories. Everything runs from a Docker image, so a GITHUB_TOKEN has to be in the environment — private repos and some requests depend on it.
What it helps with
- spot security check categories absent from a CI config
- tell which scanner in the pipeline cannot fail the build
- get paste-ready YAML for missing controls
- audit another repo's CI without cloning it
- check whether branch protection requires a control before merge
Example prompts for the agent
- Scan this repo's CI with zanadir and list what's missing
- Run
scanonrepogithub.com/owner/nameand walk me through the advisory grades - Give me
fixoutput for the CI gaps, don't touch any files
How to install zanadir
Platform CLI
claude mcp add --env GITHUB_TOKEN=<GITHUB_TOKEN> --transport stdio zanadir -- docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0Replace <…> with your own values
Platform CLI
codex mcp add zanadir --env GITHUB_TOKEN=<GITHUB_TOKEN> -- docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0Replace <…> with your own values
Config file
{
"mcpServers": {
"zanadir": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_TOKEN",
"docker.io/mustachecase/zanadir:0.20.0"
],
"env": {
"GITHUB_TOKEN": "<GITHUB_TOKEN>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"zanadir": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_TOKEN",
"docker.io/mustachecase/zanadir:0.20.0"
],
"env": {
"GITHUB_TOKEN": "<GITHUB_TOKEN>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e GITHUB_TOKEN=<GITHUB_TOKEN> zanadir docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0Replace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about zanadir
How do I install zanadir in Claude Code?
One command: claude mcp add --env GITHUB_TOKEN=<GITHUB_TOKEN> --transport stdio zanadir -- docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0. Replace the placeholder with your own GitHub token.
What does zanadir do?
It inspects CI configuration and lists missing security controls. For controls that are present, it grades whether they could actually fail a build.
How is zanadir different from OpenSSF Scorecard?
Scorecard grades a project's security practices overall; zanadir stays on CI — what is absent and whether existing checks can stop a merge. The two complement each other.
