mcp-audit Academy

This course is for two kinds of people: people who build with AI tools and have never worked in security, and engineers and security practitioners who want the detail. Every lesson is written in plain language. Sections marked “Under the hood” hold the technical detail; open them when you want it.

By the end you'll be able to

• Explain what MCP is and why its config files deserve the same care as code.
• Name the six ways an MCP setup goes wrong.
• Run a scan, read the grade, and fix the common problems.
• Check a package before installing it and a repository before trusting it.
• Pick the right features for a team or a company.

Each module ends with a three-question check, and your progress is saved in this browser. The feature catalog and glossary are there whenever you need them. This course is rebuilt with every release; it currently covers mcp-audit 0.26.0. See What's new.

Part 1 · Why

1. 1AI went from talking to doingCoding agents now read files, run commands and call APIs for you. MCP is the plug that gives them those abilities.2 min
2. 2A new attack surfaceEvery time software gains a new way to run other people's code, attackers arrive before defenders. AI agents are the newest example.3 min

Part 2 · What

1. 3What mcp-audit isAn offline security scanner and committable lock for the MCP servers your AI coding tools run.2 min
2. 4How a scan worksEight steps, from finding your config files to a grade. Then a walk through a real scan of the built-in demo.3 min

Part 3 · How

1. 5Your first 15 minutesInstall, get a grade, fix the easy things, and look at the full list.2 min
2. 6Three habitsCheck before you install, check before you trust a repo, and keep a record of what you approved.2 min
3. 7Teams and CIMake every MCP change get checked before it merges, and write your team's standard down.2 min
4. 8Going deeperLook at live servers, dependencies, source code and the other files your agent obeys.2 min
5. 9At organization scaleFind servers nobody approved, see risk across every machine, and send findings into the vulnerability program you already run.2 min