Going deeper · mcp-audit Academy

The default scan reads files. These features go further, and most of them are opt-in because they use the network or start programs.

Live server inspection

Deep inspection

mcp-audit scan --connect

What: Starts each server and reads the tools it actually offers, then checks their descriptions for hidden instructions.
Why it matters: A config only names a server. This looks at what the agent will actually be told, and catches tools that impersonate or steer toward another server's tools.

Docs: poisoning.md

Dependency CVE lookup

Deep inspection

mcp-audit scan --check-vulns

What: Looks up known vulnerabilities in each server package and everything it depends on.
Why it matters: A server can be fine while a library under it is not.

Docs: supply-chain.md

Package integrity

Deep inspection

mcp-audit scan --verify-hashes

What: Downloads each package and checks its fingerprint against a known-good one. mcp-audit verify does the same for a single package.
Why it matters: Detects a package that was swapped after it was published.

Docs: supply-chain.md

Agent instruction files

Deep inspection

mcp-audit agent-files scan

What: Checks the other text your agent obeys: CLAUDE.md, AGENTS.md, skills, Cursor rules, Copilot instructions, Claude Code subagents and hooks.
Why it matters: Instructions don't only come from MCP servers. A poisoned skill or memory file works the same way.

Docs: agent-files.md

Claude Code plugins & mods

Deep inspection

mcp-audit plugins scan

What: Inventories installed Claude Code plugins, flags ones that aren't pinned, and reviews mods that run code inside Claude Code.
Why it matters: Plugins bring servers, skills and code with them. This checks all three.

Docs: agent-files.md

IDE extension scan

Deep inspection

mcp-audit extensions scan

What: Reviews the VS Code and Cursor extensions you have installed for known vulnerabilities, sideloaded files and risky permissions.
Why it matters: Your editor's extensions sit next to your agent with the same access.

Docs: extensions.md

Server source code scan

Deep inspection

mcp-audit sast ./server-src

What: Scans the source code of an MCP server you're building or reviewing for injection, credential and auth bugs, with 91 Semgrep rules (47 Python, 44 TypeScript).
Why it matters: For people who write MCP servers, or review one before adopting it.

Docs: sast-rules.md

When there are too many findings

Use the dashboard to see the attack paths, and the kill-chain advisor to pick the few changes that matter most.

Attack graph dashboard

Deep inspection

mcp-audit dashboard

What: Opens an interactive map in your browser showing which servers can be chained into an attack.
Why it matters: Makes cross-server risk visible in one picture. Good for explaining it to others.

Docs: docs-usage.md

Kill-chain advisor

Deep inspection

mcp-audit killchain

What: Names the three changes that would cut the most attack paths, and proves it by re-running the analysis without them.
Why it matters: Tells you where to start when there are too many findings to fix at once.

Docs: killchain.md

Under the hood: measuring detection honestly

The poisoning checks are benchmarked in docs/poisoning.md on MCPTox and on the 100 most-downloaded npm MCP servers. On that real-world corpus, none of the 46 poisoning findings from mcp-audit 0.23.0 was an actual attack; most were full-width CJK punctuation, which POISON-060 no longer counts. Six checks for “orders that hide” (POISON-070..075) caught 23 of 45 held-out hand-written orders and 0 of 45 look-alike ordinary sentences. A source fingerprint test forces a re-measure whenever the poisoning code changes. That discipline is the reason to trust the numbers that are good.

Check yourself

1. Why does --connect find things a plain scan can't?

2. A server is clean but one of its libraries has a CVE. Which flag finds it?

3. What does killchain tell you?