What mcp-audit checks
mcp-audit can report 126 finding IDs, plus 5 families of IDs generated at scan time. They come from 8 built-in analyzers, 35 community rules that run by default and 91 Semgrep rules for MCP server source code.
Severities come from the severity framework and the rule files; OWASP codes from the mapping file.
Repository files that run code 5 checks
Files a cloned repository can use to start programs when you open or trust it in an AI editor: project MCP configs, VS Code tasks that run when the folder opens, and symlinks that point somewhere else.
Runs with mcp-audit scan --project .
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
TRUST-001 | MCP server defined in project-level config (TrustFall risk) | HIGH | MCP09 |
TRUST-002 | Project-scoped config path is a symlink | HIGH, MEDIUM or INFO | MCP09 MCP05 |
TRUST-003 | Repo-planted IDE auto-execution file | CRITICAL or HIGH | MCP05 MCP09 |
TRUST-004 | Config path is a symlink (user-global / explicit) | INFO | MCP09 |
TRUST-005 | Symlinked directory was not scanned | LOW | MCP09 |
Coding-agent settings 9 checks
Claude Code settings that skip permission prompts, approve every project server, pre-approve commands that can write or reach the network, or run hook commands that reach the network or touch agent config files.
Runs with mcp-audit check mcp-audit scan --project .
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
CFHYG-005 | Claude Code hooks section detected in config | MEDIUM | MCP01 MCP07 |
HARNESS-001 | Claude Code sessions start with permission prompts skipped | HIGH | MCP02 MCP07 |
HARNESS-002 | Every project .mcp.json server is approved without a prompt | HIGH | MCP09 MCP07 |
HARNESS-003 | Confirmation before bypass mode is switched off | MEDIUM | MCP02 MCP07 |
HARNESS-004 | Every shell command is pre-approved | HIGH | MCP02 MCP05 |
HARNESS-005 | Allow rules pre-approve commands that can write or reach the network | MEDIUM | MCP02 MCP05 |
HARNESS-006 | Approval is off and nothing guards recursive deletes | MEDIUM | MCP02 MCP05 |
HOOK-001 | Hook command contains network-egress instruction | HIGH | MCP05 MCP07 |
HOOK-002 | Hook command references agent config file path | HIGH | MCP05 MCP07 |
Agent instruction files 6 checks
Text the agent reads as instructions: Claude Code commands, skills and CLAUDE.md, Cursor rules, and Copilot instruction and prompt files. mcp-audit looks for injected orders, hidden characters, outside links and bundled scripts.
Runs with mcp-audit scan --project . --include-agent-files mcp-audit agent-files scan
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
MEM-001 | Imperative override instruction in memory file | MEDIUM | MCP03 |
MEM-002 | Injection pattern in memory file | MEDIUM | MCP03 |
SKILL-001 | Injection/exfiltration instruction in skill file | HIGH | MCP03 MCP01 |
SKILL-002 | Obfuscated or oversized block in skill/command file | MEDIUM | MCP03 |
SKILL-003 | Skill file references external URL | MEDIUM | MCP03 MCP04 |
SKILL-004 | Skill bundles executable scripts | INFO | MCP03 |
Claude Code plugins and mods 8 checks
Installed plugins whose recorded version does not match their marketplace pin or that follow an unpinned branch, and mods that can approve tool calls, read secrets and send data out, change what Claude reads, or start programs. Mods are read, never run.
Runs with mcp-audit check mcp-audit plugins scan
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
MOD-001 | Mod can approve tool calls before the permission prompt | HIGH | MCP07 MCP04 |
MOD-002 | Mod can read secrets or files and send data out | HIGH or MEDIUM | MCP01 MCP04 |
MOD-003 | Mod can change what Claude reads | MEDIUM | MCP03 MCP06 |
MOD-004 | Mod starts programs or changes their environment | MEDIUM | MCP05 MCP04 |
MOD-005 | Claude Code mod installed | INFO | MCP04 |
MOD-006 | Plugin directories load in every Claude Code session | MEDIUM | MCP04 |
PLUGIN-001 | Installed plugin does not match its marketplace pin | MEDIUM | MCP04 |
PLUGIN-002 | Plugin source is not pinned to a commit | LOW | MCP04 |
MCP server configs 14 checks
How each configured server is launched and reached: secrets written into the config, plain-HTTP endpoints, sudo launches, unpinned package fetches, remote servers with no authentication, and config files other users can read or write.
Runs with mcp-audit check
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
AUTH-001 | Remote MCP server configured without authentication | HIGH or MEDIUM | MCP06 |
AUTH-002 | OAuth-configured server missing audience/resource binding | MEDIUM | MCP06 |
CFHYG-001 | MCP config file is world-readable | HIGH | MCP01 |
CFHYG-002 | MCP config file resides in world-writable directory | HIGH | MCP01 MCP09 |
CFHYG-003 | Config file stores inline plaintext secret | HIGH | MCP01 |
CFHYG-004 | Config uses environment variable references for credentials | INFO | MCP01 |
CFHYG-006 | ANTHROPIC_BASE_URL overrides Anthropic API endpoint | MEDIUM | MCP01 MCP08 |
CRED-001 | API key or secret in environment variable value | HIGH | MCP01 |
CRED-002 | API key or secret in command arguments | HIGH | MCP01 |
CRED-003 | Literal secret in authentication header | HIGH or INFO | MCP01 |
TRANSPORT-001 | Unencrypted remote endpoint (HTTP) | MEDIUM | MCP07 |
TRANSPORT-002 | Elevated privilege execution (sudo/root) | HIGH | MCP02 MCP05 |
TRANSPORT-003 | Runtime package fetching without version pin | MEDIUM or LOW | MCP04 |
TRANSPORT-004 | Server binds to wildcard network interface (0.0.0.0) | HIGH | MCP07 |
Tool descriptions 15 checks
Orders hidden in the descriptions an agent reads: exfiltration instructions, prompt-format injection, behaviour overrides, invisible Unicode and lookalike characters. With --connect it reads live tool lists and flags a tool name claimed by two servers.
Runs with mcp-audit check mcp-audit scan --connect
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
COLLIDE-001 | Tool name collision: tool claimed by multiple servers | HIGH or MEDIUM | MCP01 MCP09 |
POISON-001 | Tool description contains SSH/credentials exfiltration instructions | CRITICAL | MCP03 MCP01 |
POISON-002 | Tool description contains cloud credentials exfiltration instructions | CRITICAL | MCP03 MCP01 |
POISON-003 | Tool description contains .env file exfiltration instructions | CRITICAL | MCP03 MCP01 |
POISON-010 | Tool description contains XML instruction injection | HIGH | MCP03 MCP06 |
POISON-011 | Tool description contains LLM prompt format injection markers | HIGH | MCP03 MCP06 |
POISON-012 | Tool description contains behavioral override instruction | HIGH | MCP03 MCP06 |
POISON-020 | Tool description contains data exfiltration via encoding or side channel | HIGH | MCP03 MCP10 |
POISON-021 | Tool description contains hidden parameter exfiltration | HIGH | MCP03 MCP10 |
POISON-030 | Tool description contains cross-tool manipulation instruction | MEDIUM | MCP03 MCP06 |
POISON-040 | Tool description contains zero-width Unicode characters | MEDIUM | MCP03 |
POISON-041 | Concealed instruction via concealment channel | HIGH | MCP03 MCP01 |
POISON-042 | Concealment channel present, no matched payload | LOW | MCP03 |
POISON-050 | Excessive tool description length | LOW | MCP03 |
POISON-060 | Tool description contains Unicode homoglyph characters | MEDIUM | MCP03 |
Dangerous combinations of servers 8 checks
Servers that are harmless alone but together let an injected prompt read data and send it out, or write a file another server can run. killchain ranks the changes that break the most paths.
Runs with mcp-audit check mcp-audit killchain
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
INTEG-001 | Dangerous capability combination: file write + shell execution (plant-then-execute) | HIGH | MCP05 |
TOXIC-001 | Dangerous capability combination: file read + network exfiltration | HIGH | MCP05 MCP10 |
TOXIC-002 | Dangerous capability combination: file read + email exfiltration | HIGH | MCP05 MCP10 |
TOXIC-003 | Dangerous capability combination: secrets store + network access | CRITICAL | MCP01 MCP10 |
TOXIC-004 | Dangerous capability combination: file read + shell execution | HIGH | MCP10 |
TOXIC-005 | Dangerous capability combination: database + network | HIGH | MCP05 MCP10 |
TOXIC-006 | Dangerous capability combination: shell execution + network | CRITICAL | MCP05 MCP10 |
TOXIC-007 | Capability combination: git access + network | MEDIUM | MCP10 |
Packages and supply chain 12 checks
Lookalike package names, recorded advisories for a package, deprecated versions, and missing or mismatched Sigstore provenance. Provenance and hash checks use the network, so they are opt-in.
Runs with mcp-audit vet <package> mcp-audit scan --verify-signatures
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
ATTEST-010 | Sigstore provenance verified (valid match) | INFO | none |
ATTEST-011 | Sigstore attestation from unexpected publisher | HIGH | MCP04 |
ATTEST-012 | Invalid Sigstore signature (tampered or forged) | CRITICAL | MCP04 |
ATTEST-013 | Expected Sigstore attestation missing for known-provenance package | MEDIUM | MCP04 |
ATTEST-014 | No Sigstore attestation found | MEDIUM or INFO | MCP04 |
ATTEST-015 | Sigstore attestation verification error | INFO | none |
SC-001 | Package name is one edit distance from a known-good package (typosquat) | CRITICAL | MCP04 |
SC-002 | Package name is two edits from a known-good package | HIGH | MCP04 |
SC-003 | Package name is three edits from a known-good package | MEDIUM | MCP04 |
SC-004 | Known CVE advisory recorded for this package | HIGH or MEDIUM | MCP04 |
SC-005 | Deprecated package resolved at lock time | MEDIUM | MCP04 |
ATT-… | Hash attestation finding (Layer 1 --verify-hashes). (ID generated at scan time) | varies | MCP04 |
Approved servers and drift 15 checks
What changed since you approved a setup: servers added, removed or launched differently, a hand-edited lock file, and, with --connect, tools added or changed since approval.
Runs with mcp-audit lock --verify mcp-audit check
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
BL-001 | Baseline file could not be parsed | not rated | none |
LOCK-001 | Server drifted from lock | HIGH | MCP04 |
LOCK-002 | Server not in lock | HIGH | MCP04 |
LOCK-003 | Locked server missing | MEDIUM | MCP04 |
LOCK-004 | Resolution drifted | CRITICAL or HIGH | MCP04 |
LOCK-005 | Lock file tampered or hand-edited | CRITICAL | MCP04 |
LOCK-006 | Tool added since lock | HIGH | MCP02 MCP04 |
LOCK-007 | Tool contract changed since lock | HIGH | MCP03 MCP04 |
LOCK-008 | Tool description changed since lock | MEDIUM | MCP03 MCP04 |
LOCK-009 | Tool removed since lock | LOW | MCP04 |
RUGPULL-000 | First scan — baseline recorded for server | INFO | none |
RUGPULL-001 | Server configuration changed since last scan | HIGH | MCP03 MCP04 |
RUGPULL-002 | New MCP server detected since last scan | INFO | MCP09 |
RUGPULL-003 | Previously tracked server no longer configured | INFO | none |
DRIFT-… | Baseline drift finding. (ID generated at scan time) | varies | MCP09 |
Community rules 36 checks
YAML rules in an open format that run on every scan: risky launch commands, inline code, shell metacharacters, sensitive variable names, sampling, and more.
Run on every scan. mcp-audit rule list shows the rules that are loaded.
35 of 36 community rules run by default; STDIO-001 ships disabled. The rule format is Apache 2.0 and open to contributions.
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
COMM-001 | Prohibited network binary used as MCP server | HIGH | MCP05 |
COMM-002 | curl used as MCP server binary | MEDIUM | MCP05 |
COMM-003 | Browser sandbox disabled | MEDIUM | MCP05 MCP10 |
COMM-004 | Unrecognized stdio server binary | LOW | MCP05 MCP09 |
COMM-005 | /tmp referenced in server args | MEDIUM | MCP05 |
COMM-006 | Inline code execution via -c flag | HIGH | MCP05 |
COMM-007 | eval or exec passed in server args | HIGH | MCP05 |
COMM-008 | SSH agent socket exposed to MCP server | MEDIUM | MCP01 |
COMM-009 | AWS session token exposed to MCP server | HIGH | MCP01 |
COMM-010 | npx used without pinned version | LOW | MCP04 |
COMM-011 | Broad Deno permission flags in use | MEDIUM | MCP02 |
COMM-012 | Server binds to all interfaces (0.0.0.0) | HIGH | MCP07 |
COMM-013 | npx auto-confirm flag (silent execution) | HIGH | MCP04 MCP05 |
COMM-014 | MCP Sampling capability declared | LOW | MCP04 MCP06 |
COMM-015 | Shell metacharacters in server args | CRITICAL | MCP05 |
COMM-016 | Role-claim poisoning in server args | HIGH | MCP01 |
COMM-017 | Authority-claim poisoning — AI identity impersonation | CRITICAL | MCP01 |
COMM-018 | Output-format hijack in server args | MEDIUM | MCP01 |
COMM-019 | Side-channel data exfiltration instruction in server args | HIGH | MCP01 MCP02 |
COMM-020 | Confabulation trigger in server args | HIGH | MCP01 |
COMM-021 | Env key name suggests private or secret key | HIGH | MCP02 |
COMM-022 | Env key name suggests access token | MEDIUM | MCP02 |
COMM-023 | Env key name suggests password | HIGH | MCP02 |
COMM-024 | HTTP endpoint on sensitive or production port | MEDIUM | MCP06 |
COMM-025 | Localhost endpoint with explicit SSE/HTTP transport URL | LOW | MCP06 MCP05 |
COMM-026 | Unencrypted WebSocket URL in server args | MEDIUM | MCP06 |
COMM-027 | Generic or unnamed server key | LOW | MCP07 |
COMM-028 | Command is an absolute path | MEDIUM | MCP04 |
COMM-029 | Command references a temp or volatile directory | HIGH | MCP04 |
COMM-030 | Generic-named server with network transport URL | LOW | MCP09 MCP07 |
COMM-031 | Remote MCP server configured without authentication | LOW | MCP06 |
COMM-033 | Project-level MCP config file present in repository | LOW | MCP09 |
COMM-034 | Overprivileged MCP server credential (potential god key) | MEDIUM | MCP06 |
STDIO-001 | Launcher binary not in allowlist (ships disabled) | MEDIUM | MCP04 MCP09 |
STDIO-002a | Hidden (dotfile) launcher binary | HIGH | MCP04 MCP05 |
STDIO-002b | Inline script launcher | HIGH | MCP05 |
More surfaces 3 checks
IDs generated at scan time for IDE extensions, MCP server source code, hash pins, baselines and your own governance policy.
Runs with mcp-audit extensions scan mcp-audit sast <path>
| ID | What it flags | Severity | OWASP MCP |
|---|---|---|---|
EXT-… | IDE extension security finding. (ID generated at scan time) | varies | MCP04 |
SAST-… | SAST finding from Semgrep rule execution. (ID generated at scan time) | varies | MCP01 MCP05 MCP07 |
GOV-… | Governance policy finding. (ID generated at scan time) | varies | none |
OWASP MCP Top 10
Findings carry their OWASP MCP Top 10 codes in terminal, JSON and SARIF output. The mapping is machine-readable (OWASP 2025-beta).
MCP01 Token Mismanagement and Secret Exposure 24 checks
CFHYG-001, CFHYG-002, CFHYG-003, CFHYG-004, CFHYG-005, CFHYG-006, COLLIDE-001, COMM-008, COMM-009, COMM-016, COMM-017, COMM-018, COMM-019, COMM-020, CRED-001, CRED-002, CRED-003, MOD-002, POISON-001, POISON-002, POISON-003, POISON-041, SKILL-001, TOXIC-003
MCP02 Privilege Escalation via Scope Creep 12 checks
COMM-011, COMM-019, COMM-021, COMM-022, COMM-023, HARNESS-001, HARNESS-003, HARNESS-004, HARNESS-005, HARNESS-006, LOCK-006, TRANSPORT-002
MCP03 Tool Poisoning 24 checks
LOCK-007, LOCK-008, MEM-001, MEM-002, MOD-003, POISON-001, POISON-002, POISON-003, POISON-010, POISON-011, POISON-012, POISON-020, POISON-021, POISON-030, POISON-040, POISON-041, POISON-042, POISON-050, POISON-060, RUGPULL-001, SKILL-001, SKILL-002, SKILL-003, SKILL-004
MCP04 Software Supply Chain Attacks 35 checks
ATTEST-011, ATTEST-012, ATTEST-013, ATTEST-014, COMM-010, COMM-013, COMM-014, COMM-028, COMM-029, LOCK-001, LOCK-002, LOCK-003, LOCK-004, LOCK-005, LOCK-006, LOCK-007, LOCK-008, LOCK-009, MOD-001, MOD-002, MOD-004, MOD-005, MOD-006, PLUGIN-001, PLUGIN-002, RUGPULL-001, SC-001, SC-002, SC-003, SC-004, SC-005, SKILL-003, STDIO-001, STDIO-002a, TRANSPORT-003
MCP05 Command Injection and Execution 26 checks
COMM-001, COMM-002, COMM-003, COMM-004, COMM-005, COMM-006, COMM-007, COMM-013, COMM-015, COMM-025, HARNESS-004, HARNESS-005, HARNESS-006, HOOK-001, HOOK-002, INTEG-001, MOD-004, STDIO-002a, STDIO-002b, TOXIC-001, TOXIC-002, TOXIC-005, TOXIC-006, TRANSPORT-002, TRUST-002, TRUST-003
MCP06 Intent Flow Subversion 13 checks
AUTH-001, AUTH-002, COMM-014, COMM-024, COMM-025, COMM-026, COMM-031, COMM-034, MOD-003, POISON-010, POISON-011, POISON-012, POISON-030
MCP07 Insufficient Authentication and Authorization 12 checks
CFHYG-005, COMM-012, COMM-027, COMM-030, HARNESS-001, HARNESS-002, HARNESS-003, HOOK-001, HOOK-002, MOD-001, TRANSPORT-001, TRANSPORT-004
MCP08 Lack of Audit and Telemetry 1 check
MCP09 Shadow MCP Servers 13 checks
CFHYG-002, COLLIDE-001, COMM-004, COMM-030, COMM-033, HARNESS-002, RUGPULL-002, STDIO-001, TRUST-001, TRUST-002, TRUST-003, TRUST-004, TRUST-005
MCP10 Context Injection and Over-sharing 10 checks
COMM-003, POISON-020, POISON-021, TOXIC-001, TOXIC-002, TOXIC-003, TOXIC-004, TOXIC-005, TOXIC-006, TOXIC-007
Supported clients 9 clients
mcp-audit finds these MCP config files on its own. Pass --path to scan any other file or folder.
| Client | Config file |
|---|---|
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Cursor | ~/.cursor/mcp.json |
| VS Code | .vscode/mcp.json (workspace) |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |
| Claude Code (user) | ~/.claude.json |
| Claude Code (project) | .mcp.json (project root) |
| GitHub Copilot CLI | ~/.copilot/mcp-config.json |
| Augment Code | ~/.augment/settings.json |
| Amazon Q Developer (project) | .amazonq/mcp.json (project root; scan --project only) |
Files read in a repository 17 paths
mcp-audit scan --project <dir> walks the tree for these paths; instruction files need --include-agent-files. Symlinked directories are reported, never followed.
| Path | What it is | Client |
|---|---|---|
.mcp.json | MCP config or agent settings (servers start from it) | claude-code |
.claude/settings.json | MCP config or agent settings (servers start from it) | claude-code |
.claude/settings.local.json | MCP config or agent settings (servers start from it) | claude-code |
.cursor/mcp.json | MCP config or agent settings (servers start from it) | cursor |
.cursor/settings.json | MCP config or agent settings (servers start from it) | cursor |
.vscode/mcp.json | MCP config or agent settings (servers start from it) | vscode |
.amazonq/mcp.json | MCP config or agent settings (servers start from it) | amazon-q |
.vscode/tasks.json | Editor file that can run a command when the folder opens | vscode-tasks |
.vscode/settings.json | Editor file that can run a command when the folder opens | vscode-settings |
.claude/commands/*.md | Read by the agent as instructions | claude-code |
.claude/skills/**/SKILL.md | Read by the agent as instructions | claude-code |
.claude/CLAUDE.md | Read by the agent as instructions | claude-code |
CLAUDE.md | Read by the agent as instructions | claude-code |
.cursor/rules/*.mdc | Read by the agent as instructions | cursor |
.github/copilot-instructions.md | Read by the agent as instructions | copilot |
.github/instructions/*.instructions.md | Read by the agent as instructions | copilot |
.github/prompts/*.prompt.md | Read by the agent as instructions | copilot |