mcp-audit GitHub

Open-source MCP and AI agent security scanner

Is it safe to point an AI agent at this repo?

mcp-audit reads the files an AI coding agent will run or obey, such as MCP server configs, agent settings and instruction files, and tells you what they allow. It runs on your machine. A default scan reads files, never runs them, and makes no network calls.

pip install mcp-audit-scannermcp-audit scan --project . --include-agent-files

The package is mcp-audit-scanner; the command is mcp-audit. It needs Python 3.11 or later. Standalone binaries for macOS (Apple silicon), macOS (Intel), Linux (x86-64) and Windows (x86-64) are on GitHub Releases.

Install and run For security teams

Current release: 0.21.1, released 2026-10-25. Apache 2.0, every feature free.

What it reads in a repository

your-repo/
  • Can start a program: .mcp.jsonTRUSTCREDSCTOXIC
  • Read as instructions: CLAUDE.mdMEM
  • .amazonq/
  • .claude/
    • Can start a program: settings.jsonTRUSTHARNESSHOOK
    • Can start a program: settings.local.jsonTRUSTHARNESSHOOK
    • Read as instructions: commands/*.mdSKILL
    • Read as instructions: skills/**/SKILL.mdSKILL
    • Read as instructions: CLAUDE.mdMEM
  • .cursor/
  • .github/
    • Read as instructions: copilot-instructions.mdSKILL
    • Read as instructions: instructions/*.instructions.mdSKILL
    • Read as instructions: prompts/*.prompt.mdSKILL
  • .vscode/

can start a program on your machine is read by the agent as instructions

Taken from the scanner's own discovery lists. The tags are the finding families checked in each file.

Security properties you can check

Each one links to the evidence in the source repository.

Security and quality in detail

What it checks

126 finding IDs, grouped by what mcp-audit reads. The catalog shows what each one flags, its severity and its OWASP MCP Top 10 category.

Repository files that run code5 checks

Files a cloned repository can use to start programs when you open or trust it in an AI editor: project MCP configs, VS Code tasks that run when the folder opens, and symlinks that point somewhere else.

TRUST

Coding-agent settings9 checks

Claude Code settings that skip permission prompts, approve every project server, pre-approve commands that can write or reach the network, or run hook commands that reach the network or touch agent config files.

CFHYGHARNESSHOOK

Agent instruction files6 checks

Text the agent reads as instructions: Claude Code commands, skills and CLAUDE.md, Cursor rules, and Copilot instruction and prompt files. mcp-audit looks for injected orders, hidden characters, outside links and bundled scripts.

MEMSKILL

Claude Code plugins and mods8 checks

Installed plugins whose recorded version does not match their marketplace pin or that follow an unpinned branch, and mods that can approve tool calls, read secrets and send data out, change what Claude reads, or start programs. Mods are read, never run.

MODPLUGIN

MCP server configs14 checks

How each configured server is launched and reached: secrets written into the config, plain-HTTP endpoints, sudo launches, unpinned package fetches, remote servers with no authentication, and config files other users can read or write.

AUTHCFHYGCREDTRANSPORT

Tool descriptions15 checks

Orders hidden in the descriptions an agent reads: exfiltration instructions, prompt-format injection, behaviour overrides, invisible Unicode and lookalike characters. With --connect it reads live tool lists and flags a tool name claimed by two servers.

COLLIDEPOISON

Dangerous combinations of servers8 checks

Servers that are harmless alone but together let an injected prompt read data and send it out, or write a file another server can run. killchain ranks the changes that break the most paths.

INTEGTOXIC

Packages and supply chain11 checks

Lookalike package names, recorded advisories for a package, deprecated versions, and missing or mismatched Sigstore provenance. Provenance and hash checks use the network, so they are opt-in.

ATTESTSC

Approved servers and drift14 checks

What changed since you approved a setup: servers added, removed or launched differently, a hand-edited lock file, and, with --connect, tools added or changed since approval.

BLLOCKRUGPULL

Community rules36 checks

YAML rules in an open format that run on every scan: risky launch commands, inline code, shell metacharacters, sensitive variable names, sampling, and more.

COMMSTDIO

Browse the full catalog

Two ways in

The same scanner, from one developer's laptop to every repository and machine in an organisation. Anything that uses the network is opt-in.

For developers

  • Check a server before you install it

    mcp-audit vet @modelcontextprotocol/server-filesystem

    Publisher, recorded advisories, capabilities and lookalike names, offline.

  • Scan a cloned repo before your editor trusts it

    mcp-audit scan --project . --include-agent-files

    Project MCP configs, agent settings, editor auto-run files and instruction files.

  • Grade your setup and apply safe fixes

    mcp-audit check

    The top findings with a fix for each. mcp-audit fix shows the safe fixes as a diff; --apply writes them.

  • See findings as you work

    Use the editor extension for VS Code and Cursor and pre-commit hooks.

Developer quick start

For security teams

  • Gate pull requests in CI

    The GitHub Action uploads SARIF to code scanning, fails at the severity you choose and verifies mcp-lock.json against the servers you approved.

  • Enforce what is allowed

    A .mcp-audit-policy.yml file sets approved servers, a minimum score, transport rules and finding tolerances. Scans find it on their own.

  • See every machine

    mcp-audit shadow lists servers nobody approved; mcp-audit merge turns many machines' scans into one fleet report.

  • Keep evidence

    CycloneDX SBOMs, Sigstore-signed snapshots you can replay later, and a PDF report from scan --report pdf.

  • Feed your vulnerability management

    SARIF, Nucleus Security FlexConnect through push-nucleus, and NDJSON streams for a SIEM.

Guide for security teams

Fits the tools you already run

Open formats in, open formats out. No agent to deploy and no service to connect.

  • GitHub code scanningSARIF output with the OWASP MCP Top 10 taxonomy.
  • GitHub ActionsA composite Action, pinned to v0.21.1, that scans, uploads SARIF and gates the job.
  • pre-commit2 hooks: a scan, and lock verification that blocks drift.
  • VS Code and CursorAn Open VSX extension that shows findings inline as you edit.
  • Nucleus SecurityFlexConnect output and a direct push for vulnerability management programs.
  • CycloneDXSBOMs and AI/ML-BOM snapshots, optionally signed with Sigstore.
  • OSVA signed advisory feed with a bundle osv-scanner can read.
  • SIEMNDJSON from snapshot --stream and shadow --continuous, with Splunk and Sentinel recipes.

CI, editor and output setup

Look up a server before you install it

The registry lists 55 MCP server packages (45 npm, 10 PyPI). 26 have a verified publisher. 14 have recorded advisories, and 5 of those have at least one with no fix. Each package has a page and a JSON verdict.

Browse the registry Add your server

Why remote servers matter

  • A measurement study found that 40.55% of 7,973 live remote MCP servers expose tools without authentication (arXiv 2605.22333). AUTH-001 flags a remote server in your config that sends no credentials.
  • Censys counted 12,520 MCP services reachable from the internet (MCP Servers on the Internet).

We publish our false positives

We scanned the 100 most-downloaded MCP servers on npm and published every aggregate number. mcp-audit's poisoning rules raised 661 findings, and none of them was a real attack. 488 of them came from one rule, POISON-060, which the data shows misfiring.

What we measured

Recent releases

The lead lines of the newest entries in the changelog.

0.21.1 2026-10-25

  • Releases: merging a version bump to main now tags and publishes it
  • setuptools 84.0.0 → 84.2.1 in the lockfile
  • Registry: five advisories added from OSV
  • Refreshed vulnerable dependencies in the lockfile, which is what the standalone binaries are built from

0.21.0 2026-10-13

  • scan --connect dropped every tool's input schema with mcp 2.x
  • scan --connect read only the first page of a paginated tool list

0.20.0 2026-10-13

  • What replaced the approval prompt
  • Claude Code mods audit
  • Weekly registry advisory check
  • Rug-pull docs say what the code hashes

Read the full changelog

Open source, with nothing held back

mcp-audit is Apache 2.0. Every command ships in the free package: no license keys, no seats, no account and no paid tier. The source, the test suite, the detection sources and the known gaps are all public.

The community rule format is open. Accepted rules are credited in the changelog and in the contributors list.

Source on GitHub Write a rule