1. Conduid
  2. Security
  3. Truecopy Action
MCP server · Security

Truecopy Action

by · github.com/askalf/truecopy-action

Gate every agent skill & MCP server change in CI — the GitHub Action for truecopy, the supply-chain gate for AI agents. Verify truecopy.lock for drift & poisoning, or poison-scan a manifest / marketplace. Part of Own Your Stack.

Unclaimed agent-securityai-agentsgithub-actionsmcpown-your-stacksupply-chain
InstallView source
34Low

Scored 14 days ago · breakdown

About Truecopy Action

Truecopy Action is an MCP server published by askalf in the Security category: gate every agent skill & MCP server change in CI — the GitHub Action for truecopy, the supply-chain gate for AI agents. Verify truecopy.lock for drift & poisoning, or poison-scan a manifest / marketplace. Part of Own Your Stack.

The repository has 1 stars and 0 forks, with the last commit 20 days ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/askalf/truecopy-action

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Truecopy Action

Powered by Claude · Grounded in docs

I know everything about Truecopy Action. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Releases

v1.1.2v1.1.2 · 27 Sep 2026Fixed The action now installs on non-root self-hosted runners.** It ran `npm install -g`, which writes npm's global prefix. On a runner whose user cannot write that prefix (a distro node under `/usr/lib`), the install failed with `ENOENT:…
v1.1.1v1.1.1 · 25 Sep 2026This release also moves the `v1` tag, which had been left on v1.0.3 when v1.1.0 shipped. Until now `@v1` did not have the `require-signed` input: a workflow setting `require-signed: true` on `@v1` got an "unexpected input" warning and…
v1.1.0v1.1.0 — require-signed · 17 Aug 2026verify gains a require-signed input: fail any pinned entry lacking a valid signature from a trusted key. Off by default; a policy ratchet for repos whose whole pinned set is signed. Self-tested both directions in CI (unsigned pin fails;…
v1.0.3v1.0.3 — redstamp PowerShell array-form bypass fix, propagated · 5 Aug 2026Changed Default `truecopy-ref` moved `v0.10.1` → `v0.10.3`.** truecopy 0.10.3 carries its redstamp dependency forward, `0.7.3` → `0.7.5`: a proven bypass of redstamp's deterministic black gate via PowerShell's `-ArgumentList` array form…
v1.0.2v1.0.2 — npm v12 compatibility, transitively · 1 Aug 2026Ships six commits that had been sitting on `master` unreleased — including both halves of the npm v12 fix. Anyone pinning `@v1` has been getting the pre-#13 action since 2026-07-12. Fixed — npm v12 compatibility npm v12 [blocks git…
Questions

About Truecopy Action

How do I install Truecopy Action?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Truecopy Action safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Truecopy Action still maintained?

Yes — the latest release is v1.1.2 (27 Sep 2026), and the last commit was 20 days ago. The repository has 1 stars.