What is git-steer?
git-steer is a self-hosting GitHub autonomy engine that provides 100% autonomous control over your GitHub account through a Model Context Protocol (MCP) server. It scans repositories for security vulnerabilities, tracks remediation via RFC issues, and generates this dashboard automatically.
This dashboard is regenerated daily by a GitHub Actions workflow and deployed to GitHub Pages. No local machine required.
Reading the Metrics
- Total CVEs
- Total Common Vulnerabilities and Exposures detected across all scanned repositories.
- Fixed
- Number of CVEs that have been remediated with patches or dependency updates.
- Fix Rate
- Percentage of detected CVEs resolved. Green ≥80%, Yellow ≥50%, Red <50%.
- Avg MTTR
- Mean Time To Resolution — average hours from CVE detection to fix. Green ≤24h, Yellow ≤48h, Red >48h.
- Open RFCs
- Active Request for Change issues tracking vulnerability remediation in progress.
- Total Runs
- Number of code quality tool executions (e.g. CodeQL scans) across repositories.
- Total Errors
- Code quality issues classified as errors requiring immediate attention.
- Total Warnings
- Code quality issues classified as warnings for review.
Dashboard Features
- 5 interactive tabs: Overview, CVE Details, Repositories, Code Quality, and this About page
- Global severity filter: Click CRITICAL / HIGH / MEDIUM / LOW to filter across all tabs
- Sortable tables: Click any column header to sort ascending/descending
- Live search: Type to filter CVE and quality tables in real time
- Expandable repo cards: Click to drill into per-repo vulnerability details
- Hover tooltips: Hover over metric cards for descriptions
- Click-to-copy CVE IDs: Click any CVE link to copy the ID to clipboard
- CSV export: Download the current tab's data as a CSV file
- NVD links: Every CVE ID links directly to the NVD detail page
Keyboard Shortcuts
- 1 – 5 — Switch between tabs
- Esc — Close any open modal or panel
- ? — Toggle keyboard shortcuts hint
Automation
This dashboard is automatically refreshed daily at 6:00 AM UTC by the Heartbeat GitHub Actions workflow. The workflow scans all managed repositories for Dependabot alerts, regenerates the dashboard HTML, and deploys it to GitHub Pages.
You can also trigger a manual refresh using the Run Security Scan button in the header, which dispatches the workflow on demand.
Contribute
Found something wrong? Have an idea? We welcome contributions and feedback.
Links