GitHub Action

axiorank/verify-action is a shift-left gate for the AI agent supply chain. On every pull request it does two things against your live AxioRank workspace:

1. Preflights MCP servers: scans the repo for MCP config files (mcp.json, claude_desktop_config.json, .cursor/mcp.json, axiorank.json), extracts every remote server URL, and verifies each through card verification: signature check, key-domain anchoring, and supply-chain risk scoring.
2. Simulates tool-call fixtures against your live policy set, so a policy regression (or a fixture your policies should deny) fails the build before it ships.

Findings appear as PR annotations on the file that referenced the server or fixture.

Setup

name: AxioRank Verify
on: [pull_request]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: axiorank/verify-action@v1
        with:
          api-key: ${{ secrets.AXIORANK_API_KEY }}
          fixtures-dir: .axiorank/fixtures
          fail-on: deny

Create a scoped API key under Settings → API Keys with cards:verify (server preflights) and policies:read (fixture simulation), and store it as a repository secret.

Fixtures

Each JSON file in fixtures-dir is one tool call to simulate:

{
  "tool": "aws.s3.delete_bucket",
  "arguments": { "bucket": "prod-backups" },
  "environment": "production"
}

Inputs

Next steps

• Policies: what the simulation evaluates.
• Protocol adapters: what card verification inspects.