Report Grype findings on pull requests

[danbarr]

Summary

• Publish detailed Grype JSON artifacts before the vulnerability gate fails.
• Report fixable High and Critical package findings in the failed build job.
• Maintain a sticky PR comment with affected packages and available fixed versions.

Validation

• git diff --check
• Embedded GitHub Script syntax check
• actionlint: existing findings remain for concurrency.queue and pre-existing shellcheck warnings.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ adb-mysql-mcp-server

• Status: Passed
• Tools scanned: 3
• Result: No security issues detected

✅ agentql-mcp

• Status: Passed
• Tools scanned: 1
• Result: No security issues detected

---

Summary: Scanned 2 MCP server(s), all passed security checks. ✅