github · mcp-server-typescriptHEAD

Evidence

import express, { Request as ExpressRequest, Response, NextFunction } from 'express';

import { randomUUID } from "node:crypto";

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";

import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";

import { z } from 'zod';

import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";

import { DataForSEOClient,

Remediation

Apply auth middleware at the route or router level: - Express / Fastify / Koa: `passport.authenticate(...)`, `requireAuth`, `verifyToken`, or an equivalent JWT middleware applied via `router.use(authMw)` or as a per-route handler. - FastAPI: `Depends(get_current_user)`, `OAuth2PasswordBearer`, `HTTPBearer`, or `verify_jwt` dependency. - Flask: `@login_required`, `@auth_required`, `@jwt_required`, or call `verify_jwt_in_request()` in the handler. Mounting MCP behind a s

Evidence

#!/usr/bin/env node

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { DataForSEOClient, DataForSEOConfig } from '../core/client/dataforseo.client.js';

import { SerpApiModule } from '../core/modules/serp/serp-api.module.js';

import { KeywordsDataApiModule } from '../core/modules/keywords-data/keywords-data-api.module.js';

import { OnPageApiModule } from '../core/modules/onpage/onpage-api.module.js';

import { DataForSEOLabsApi } from '../core/modules/dataforseo-labs/dat

Remediation

Apply auth middleware at the route or router level: - Express / Fastify / Koa: `passport.authenticate(...)`, `requireAuth`, `verifyToken`, or an equivalent JWT middleware applied via `router.use(authMw)` or as a per-route handler. - FastAPI: `Depends(get_current_user)`, `OAuth2PasswordBearer`, `HTTPBearer`, or `verify_jwt` dependency. - Flask: `@login_required`, `@auth_required`, `@jwt_required`, or call `verify_jwt_in_request()` in the handler. Mounting MCP behind a s

Evidence

async handle(params:any): Promise<any> {

    try {

      console.error(JSON.stringify(params, null, 2));

      const response = await this.dataForSEOClient.makeRequest(`/v3/serp/youtube/organic/live/advanced`, 'POST', [{

        keyword: params.keyword,

        location_name: params.location_name,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

async handle(params:any): Promise<any> {

    try {

      console.error(JSON.stringify(params, null, 2));

      const response = await this.dataForSEOClient.makeRequest(`/v3/serp/youtube/video_info/live/advanced`, 'POST', [{

        video_id: params.video_id,

        location_name: params.location_name,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

await server.connect(transport);

      console.error('handle request');

      await transport.handleRequest(req , res, req.body);

      console.error('end handle request');

      req.on('close', () => {

        console.error('Request closed');

        transport.close();

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

async handle(params:any): Promise<any> {

    try {

      console.error(JSON.stringify(params, null, 2));

      const response = await this.dataForSEOClient.makeRequest(`/v3/serp/${params.search_engine}/organic/live/advanced`, 'POST', [{

        location_name: params.location_name,

        language_code: params.language_code,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

};

const handleNotAllowed = (method: string) => async (req: Request, res: Response) => {

    console.error(`Received ${method} request`);

    res.status(405).json({

      jsonrpc: "2.0",

      error: {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

});

    } catch (error) {

      console.error('Error handling MCP request:', error);

      if (!res.headersSent) {

        res.status(500).json({

          jsonrpc: '2.0',

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

});

      await server.connect(transport);

      console.error('handle request');

      await transport.handleRequest(req , res, req.body);

      console.error('end handle request');

      req.on('close', () => {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

};

  const handleNotAllowed = (method: string) => async (req: Request, res: Response) => {

    console.error(`Received ${method} request`);

    res.status(405).json({

      jsonrpc: "2.0",

      error: {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

});

      await server.connect(transport);

      console.error('handle request');

      await transport.handleRequest(req , res, req.body);

      console.error('end handle request');

      req.on('close', () => {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

'User-Agent': `DataForSEO-MCP-TypeScript-SDK/${version}`

    };

    console.error(`Making request to ${url} with method ${method} and body`, body);

    const response = await fetch(url, {

      method,

      headers,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

async handle(params: any): Promise<any> {

        try {

            console.error(JSON.stringify(params, null, 2));

            const response = await this.dataForSEOClient.makeRequest(`/v3/serp/youtube/video_comments/live/advanced`, 'POST', [{

                video_id: params.video_id,

                location_name: params.location_name,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

//=============================================================================

app.get('/sse', basicAuth, async (req: Request, res: Response) => {

  console.log('Received GET request to /sse (deprecated SSE transport)');

  // Handle credentials

  if (!req.username && !req.password) {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

async handle(params: any): Promise<any> {

    try {

      console.error(JSON.stringify(params, null, 2));

      const response = await this.dataForSEOClient.makeRequest(`/v3/ai_optimization/ai_keyword_data/keywords_search_volume/live`, 'POST', [{

        keywords: params.keywords,

        location_name: params.location_name,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

});

    } catch (error) {

      console.error('Error handling MCP request:', error);

      if (!res.headersSent) {

        res.status(500).json({

          jsonrpc: '2.0',

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

await server.connect(transport);

      console.error('handle request');

      await transport.handleRequest(req , res, req.body);

      console.error('end handle request');

      req.on('close', () => {

        console.error('Request closed');

        transport.close();

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

async handle(params:any): Promise<any> {

    try {

      console.error(JSON.stringify(params, null, 2));

      const response = await this.dataForSEOClient.makeRequest(`/v3/serp/youtube/video_subtitles/live/advanced`, 'POST', [{

        video_id: params.video_id,

        location_name: params.location_name,

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

}

export default {

  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {

    const url = new URL(request.url);

    // Store environment in global context for McpAgent access

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

    // MCP endpoints using McpAgent pattern

    if (url.pathname === "/sse" || url.pathname === "/sse/message") {

      return DataForSEOMcpAgent.serveSSE("/sse").fetch(request, env, ctx);

    }

    if (url.pathname === "/mcp" || url.pathname == '/http') {

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/reportError) */

declare function reportError(error: any): void;

/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/fetch) */

declare function fetch(input: RequestInfo | URL, init?: RequestInit<RequestInitCfProperties>): Promise<Response>;

declare const self: ServiceWorkerGlobalScope;

/**

* The Web Crypto API provides a set of low-level functions for common cryptographic tasks.

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

readonly compatibilityFlags: Record<string, boolean>;

}

interface DurableObject {

    fetch(request: Request): Response | Promise<Response>;

    alarm?(alarmInfo?: AlarmInvocationInfo): void | Promise<void>;

    webSocketMessage?(ws: WebSocket, message: string | ArrayBuffer): void | Promise<void>;

    webSocketClose?(ws: WebSocket, code: number, reason: string, wasClean: boolean): void | Promise<void>;

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

type Service<T extends Rpc.WorkerEntrypointBranded | undefined = undefined> = Fetcher<T>;

type Fetcher<T extends Rpc.EntrypointBranded | undefined = undefined, Reserved extends string = never> = (T extends Rpc.EntrypointBranded ? Rpc.Provider<T, Reserved | "fetch" | "connect"> : unknown) & {

    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;

    connect(address: SocketAddress | string, options?: SocketOptions): Socket;

};

interface KVNamespaceListKey<Metadata, Key exte

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

queueMicrotask(task: Function): void;

    structuredClone<T>(value: T, options?: StructuredSerializeOptions): T;

    reportError(error: any): void;

    fetch(input: RequestInfo | URL, init?: RequestInit<RequestInitCfProperties>): Promise<Response>;

    self: ServiceWorkerGlobalScope;

    crypto: Crypto;

    caches: CacheStorage;

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

    if (url.pathname === "/mcp" || url.pathname == '/http') {

      return DataForSEOMcpAgent.serve("/mcp").fetch(request, env, ctx);

    }

    return new Response("Not found", { status: 404 });

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

name: 'dfs-crawlability-audit',

    title: 'Identify technical performance issues affecting crawlability and ranking',

    params: {

      url: z.string().describe('The URL of the page to analyze'),

    },

    handler: async (params) => {

      return {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

name: 'dfs-performance-mobile-check',

    title: 'Check for slow load time and mobile compatibility issues',

    params: {

      url: z.string().describe('The URL of the page to analyze'),

    },

    handler: async (params) => {

      return {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

name: 'dfs-meta-tags-check',

    title: 'Detect missing or duplicate meta tags hurting SEO',

    params: {

      url: z.string().describe('The URL of the page to analyze'),

    },

    handler: async (params) => {

      return {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

getParams(): z.ZodRawShape {

    return {

      url: z.string().describe("URL to analyze"),

      enable_javascript: z.boolean().optional().describe("Enable JavaScript rendering"),

      custom_js: z.string().optional().describe("Custom JavaScript code to execute"),

      custom_user_agent: z.string().optional().describe("Custom User-Agent header"),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

getParams(): z.ZodRawShape {

    return {

      url: z.string().describe("URL of the page to parse"),

      enable_javascript: z.boolean().optional().describe("Enable JavaScript rendering"),

      custom_user_agent: z.string().optional().describe("Custom User-Agent header"),

      accept_language: z.string().optional().describe("Accept-Language header value"),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

name: 'dfs-keyword-content-gaps',

    title: 'Analyze keyword optimization and content gaps',

    params: {

      url: z.string().describe('The URL of the page to analyze'),

      keyword: z.string().describe('The primary keyword to optimize for'),

    },

    handler: async (params) => {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

name: 'dfs-internal-linking-audit',

    title: 'Evaluate internal linking and crawl depth for better indexing',

    params: {

      url: z.string().describe('The URL of the page to analyze'),

    },

    handler: async (params) => {

      return {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

getParams(): z.ZodRawShape {

    return {

      url: z.string().describe("URL of the page to parse"),

      enable_javascript: z.boolean().optional().describe("Enable JavaScript rendering"),

      custom_user_agent: z.string().optional().describe("Custom User-Agent header"),

      accept_language: z.string().optional().describe("Accept-Language header value"),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"build": "tsc && node -e \"require('fs').chmodSync('build/main/main/cli.js', '755')\"",

    "start": "node build/main/main/index.js",

    "dev": "tsc --watch",

    "prepare": "npm run build",

    "http": "node build/main/main/index-http.js",

    "sse": "node build/main/main/index-sse-http.js",

    "cli": "node build/main/main/cli.js",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

FROM node:22-alpine

# Set working directory

WORKDIR /app

# Copy package files

COPY package*.json ./

# Install dependencies

# Use npm ci if lock file exists, else fallback to npm install

RUN if [ -f package-lock.json ]; then npm ci --ignore-scripts; else npm install --ignore-scripts; fi

# Copy rest of the project

COPY tsconfig.json ./

COPY src/ ./src/

# Build the project

RUN npm run build

# Expose app port

EXPOSE 3000

# Set production environment

ENV NODE_ENV=production

# Set entrypoint a

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Evidence

uses: actions/checkout@v6

      - name: Setup Node.js

        uses: actions/setup-node@v6

        with:

          node-version: '24'

          registry-url: 'https://registry.npmjs.org'

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

echo "IMAGE_VERSION=${TAG_VERSION#v}" >> $GITHUB_ENV

      - name: Log in to Docker Hub

        uses: docker/login-action@v3

        with:

          username: ${{ secrets.DOCKER_USERNAME }}

          password: ${{ secrets.DOCKER_TOKEN }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

environment: npm

    steps:

      - name: Checkout code

        uses: actions/checkout@v6

      - name: Setup Node.js

        uses: actions/setup-node@v6

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

password: ${{ secrets.DOCKER_TOKEN }}

      - name: Set up Docker Buildx

        uses: docker/setup-buildx-action@v3

      - name: Build and push

        uses: docker/build-push-action@v6

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: docker/setup-buildx-action@v3

      - name: Build and push

        uses: docker/build-push-action@v6

        with:

          context: .

          platforms: linux/amd64,linux/arm64

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

environment: dockerhub

    steps:

      - name: Checkout code

        uses: actions/checkout@v4

      - name: Set image version

        run: |

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc