Add MCP Shield security scan

[thuggeelya]

Summary

Adds MCP Shield CI workflow for automated security scanning and security badge to README.
On every PR, the workflow posts a detailed comment with findings, affected tools, and recommendations.

Scan results

Score: 92/100 (Grade: A)
22 checks | 15 passed | 0 failed | 6 warnings

Findings

⚠️ SEC-001 WARN — Found 1 poisoning indicator(s) (CWE-94)

• [low] Excessively long description (2006 chars)

⚠️ COMP-009 WARN — 4 field(s) missing constraints

• resolve-library-id.query: string without maxLength
• resolve-library-id.libraryName: string without maxLength
• query-docs.libraryId: string without maxLength
• query-docs.query: string without maxLength

⚠️ ADV-001 WARN — 1 tool(s) reference authentication credentials

• query-docs: auth

⚠️ ADV-004 WARN — 2 tool(s) may handle sensitive data

• resolve-library-id: personal data
• query-docs: personal data

⚠️ ADV-005 WARN — 2 tool(s) access external network

• resolve-library-id (network verb)
• query-docs (network verb)

⚠️ SEC-002 WARN — Found 2 potential injection vector(s) (CWE-78, CWE-89, CWE-22)

• [medium] Potential injection vector: resolve-library-id.query
• [medium] Potential injection vector: query-docs.query

Recommendations

🔴 Review injection risks (2 found) — Add maxLength/pattern to schemas, or --deny high-risk tools

Affected: resolve-library-id.query, query-docs.query
🔵 Improve schemas (4 fields) — Add descriptions, maxLength, and pattern constraints to inputSchema fields
Affected: resolve-library-id.query, resolve-library-id.libraryName, query-docs.libraryId, query-docs.query

---

MCP Shield · Check reference