Add MCP Shield security scan

[thuggeelya]

Summary

Adds MCP Shield CI workflow for automated security scanning and security badge to README.
On every PR, the workflow posts a detailed comment with findings, affected tools, and recommendations.

Scan results

Score: 87/100 (Grade: A-)
22 checks | 18 passed | 0 failed | 3 warnings

Findings

⚠️ COMP-009 WARN — 2 field(s) missing constraints

• run_command.command: string without maxLength
• run_command.service: string without maxLength

⚠️ SEC-002 WARN — Found 1 potential injection vector(s) (CWE-78, CWE-89, CWE-22)

• [high] Potential injection vector: run_command.command

⚠️ SEC-004 WARN — Found 1 dangerous operation(s) (CWE-78, CWE-250)

• [medium] Execution operation: run_command

Recommendations

🔴 Block dangerous tools (1 found) — Add --deny rules in the proxy or require user confirmation

Affected: run_command
🔴 Review injection risks (1 found) — Add maxLength/pattern to schemas, or --deny high-risk tools
Affected: run_command.command
🔵 Improve schemas (2 fields) — Add descriptions, maxLength, and pattern constraints to inputSchema fields
Affected: run_command.command, run_command.service

---

MCP Shield · Check reference