mcp-conformance-action

This project is a GitHub Action designed to execute user-provided shell commands for installing, building, and starting an MCP server for testing. The commands (`install_command`, `build_command`, `start_command`, `pre_test_command`, `post_test_command`, `http_start_command`) are executed using `sh -c` or `spawn` without explicit input sanitization within the action's source code. This introduces a command injection vulnerability if the inputs to the action (e.g., from a pull request by an untrusted user) contain malicious shell commands. While this is a common pattern for GitHub Actions that run user scripts, it means the security depends entirely on the trustworthiness of the workflow definition and its inputs, rather than the action itself providing safeguards. It is not an MCP server itself, but a tool for testing them.