Server Variance Authority

S.V.A. MCP server

Ask the SVA from your agent

  1. Add it to Claude CodeOne command. It is read-only and needs no key.
    claude mcp add --transport http sva https://your-sva-site/api/mcp
  2. Or any MCP clientCursor, VS Code, Windsurf and others take a remote HTTP server in their MCP config:
    {"mcpServers":{"sva":{"type":"http","url":"https://your-sva-site/api/mcp"}}}
  3. Ask it things“Pods are crash-looping in prod. Which read-only skills should I start with?” Your agent can call:
    • search_skills finds skills for an incident or task, with safety labels
    • get_skill a skill's full case file and install command
    • skills_for_incident skills per phase: detect, triage, mitigate, postmortem
    • get_runbook step-by-step handbooks, read-only steps first
    • get_stack stack bundles with one install command

All skills / CI

github-actions-hardening

Read-only

Reviews workflow files for security problems such as risky triggers, injected expressions, broad token permissions and unpinned actions.

github/awesome-copilot/skills/github-actions-hardeningAudited · 3 partners pass
Stars
★ 40k
Installs
2.1k
Last commit
License
MIT
Partner audits✓ Gen Agent Trust Hub · SAFE✓ Socket✓ Snyk · LOW

Installs and audits via skills.sh. Their audits are kept separate from our label.

Why this label

Label set by hand during review; the scanner alone could not decide it. Not yet confirmed as reviewed.

Helps with

Phases

Detect

Install

npx skills add github/awesome-copilot --skill github-actions-hardening

S.V.A. field guide

How to use github-actions-hardening

  1. Install the skillRun this in your project. It adds the SKILL.md files where your agent looks for them.
    npx skills add github/awesome-copilot --skill github-actions-hardening
  2. Reference it in your agentClaude Code, Codex, Cursor and other agents pick installed skills up on their own. To be sure, name it in your request:
    Use the github-actions-hardening skill. Here is the task: …
  3. Put it to workHand it a real job and read what it plans before it runs anything. Check the risk label first: anything above read can change state.