# zanadir

Reads a repo's CI configuration and reports which security checks are absent, plus which present ones can never fail a build.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 175
- Author: MustacheCase
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/MustacheCase/zanadir
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/zanadir

## What it does

It covers six CI systems: GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Azure Pipelines and Jenkins. You point it at a local checkout or at a GitHub repo it reads without cloning. Twelve control categories — dependency scanning, secret detection, SBOMs, workflow hardening and the rest — get matched against the tools that supply them, and suggested fixes follow the repo's languages.

Presence is not the whole story. A scanner sitting behind `continue-on-error`, `--exit-code 0`, `|| true` or `allow_failure` shows up in the file yet cannot block a merge. zanadir labels each control enforcing, partial, advisory or unknown. Pass `--required-checks` and a control counts as enforcing only when branch protection or a ruleset demands it.

The MCP mode exposes two read-only tools. `scan` hands back a JSON report; `fix` returns config snippets for the gaps and writes nothing. Both accept `dir` or `repo`, plus `excludedCategories`. Everything runs from a Docker image, so a `GITHUB_TOKEN` has to be in the environment — private repos and some requests depend on it.

## Requirements
- Needs: Docker
- Environment variables: `GITHUB_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env GITHUB_TOKEN=<GITHUB_TOKEN> --transport stdio zanadir -- docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add zanadir --env GITHUB_TOKEN=<GITHUB_TOKEN> -- docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "zanadir": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "GITHUB_TOKEN",
                "docker.io/mustachecase/zanadir:0.20.0"
            ],
            "env": {
                "GITHUB_TOKEN": "<GITHUB_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "zanadir": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "GITHUB_TOKEN",
                "docker.io/mustachecase/zanadir:0.20.0"
            ],
            "env": {
                "GITHUB_TOKEN": "<GITHUB_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e GITHUB_TOKEN=<GITHUB_TOKEN> zanadir docker run -i --rm -e GITHUB_TOKEN docker.io/mustachecase/zanadir:0.20.0
```
Replace <…> with your own values

## When to use it
- spot security check categories absent from a CI config
- tell which scanner in the pipeline cannot fail the build
- get paste-ready YAML for missing controls
- audit another repo's CI without cloning it
- check whether branch protection requires a control before merge

## Example prompts
- Scan this repo's CI with zanadir and list what's missing
- Run `scan` on `repo` `github.com/owner/name` and walk me through the advisory grades
- Give me `fix` output for the CI gaps, don't touch any files

## Similar
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md