Feature catalog

mcp-audit check

What

Scans every MCP config on your machine and prints a letter grade, a 0–100 score, your top five issues and a fix hint for each.

Why it matters

You get an answer in seconds without reading a long report. Start here.

Docs: check.md

mcp-audit scan

What

The complete report: every finding with its severity, the server it's on, evidence and an OWASP MCP Top 10 code.

Why it matters

The detail behind the grade, and the formats other tools read.

Docs: docs-usage.md

mcp-audit discover

What

Lists the AI clients it found (10 are supported) and the MCP servers each one runs.

Why it matters

Most people don't know how many servers they have. This is the inventory.

Docs: clients.md

mcp-audit fix --apply

What

Rewrites your config to fix the safe, mechanical problems: moves pasted secrets to environment variables, upgrades http:// to https://, replaces a look-alike package with the real one.

Why it matters

Fixes the common mistakes without you editing JSON by hand.

Docs: fix.md

mcp-audit vet <package>

What

Before you add a server, tells you if the name is known, whether it looks like a typo of a real package, its known CVEs and what it can do.

Why it matters

Catches look-alike and known-bad packages before they run on your machine.

Docs: vet.md

mcp-audit scan --project ./cloned-repo

What

Walks a repository you just cloned and reports every MCP server and every file that would run code the moment you open the folder in your editor.

Why it matters

Run it before you click “Trust this folder”. That click is where repo-planted attacks start.

Docs: agent-execution-surface.md

mcp-audit watch

What

Keeps running and re-scans whenever an MCP config file changes.

Why it matters

You learn about a risky change when it happens, not next week.

Docs: docs-usage.md

Open VSX: mcp-audit.mcp-audit-vscode

What

Shows mcp-audit findings as squiggles inside your MCP config files while you edit them. Install it from Open VSX in Cursor, Windsurf, VSCodium or any editor that uses Open VSX.

Why it matters

Security feedback where you already work, no terminal needed. Not yet on Microsoft's VS Code Marketplace; VS Code users can download the .vsix from the Open VSX page and choose “Install from VSIX”.

Docs: ide-extension.md

mcp-audit baseline save

What

Saves a snapshot of a machine's MCP setup under a name, and later compares the machine against it.

Why it matters

Tells you what changed on a laptop since it was last known good.

Docs: baselines.md

mcp-audit affected <CVE or package@range>

What

Give it an advisory ID or a package and version range, and it answers for every MCP server on the machine: affected, not affected, or couldn't check, with the evidence. --fix shows the pin that closes it; --format openvex writes a VEX document.

Why it matters

Turns “there's a new CVE in an agent tool” into a yes or no for your own setup in one command, and says what the server could reach if it was affected.

Docs: affected.md

mcp-audit lock

What

Writes mcp-lock.json, a record of the servers you approved. Commit it. lock --verify fails if anything changes; lock --accept approves a reviewed change.

Why it matters

Turns “someone quietly changed a server” into a failed check in a pull request.

Docs: lock.md

uses: adudley78/mcp-audit@v0.26.0

What

Runs mcp-audit on every push and pull request and posts findings to the GitHub Security tab.

Why it matters

Every change to an MCP config is checked automatically before it merges.

Docs: github-action.md

pre-commit: id mcp-audit

What

Blocks a commit when a staged JSON config has HIGH or worse findings.

Why it matters

Stops a pasted API key from ever reaching the repository.

Docs: pre-commit.md

mcp-audit diff HEAD~1 HEAD

What

Shows what changed between two versions of your MCP setup: servers added or removed, new capabilities, new endpoints, new secrets, each with a risk level.

Why it matters

Reviewers see the security meaning of a config change, not just changed JSON lines.

Docs: diff.md

mcp-audit policy init

What

A YAML file of your organization's rules: which servers are approved, minimum score, allowed transports, findings you won't accept.

Why it matters

Your team's standard is written down and checked on every scan.

Docs: governance.md

mcp-audit rule validate my-rule.yml

What

Write your own checks in YAML. 35 community rules already run on every scan.

Why it matters

Encode the thing your team keeps getting wrong, once.

Docs: writing-rules.md

mcp-audit lock --connect --save-tool-text

What

Optionally saves each tool's text beside the lock, so a lock alert shows the old and new wording side by side instead of only saying a tool changed.

Why it matters

A reviewer can judge a changed tool in one look.

Docs: lock.md

mcp-audit scan --connect

What

Starts each server and reads the tools it actually offers, then checks their descriptions for hidden instructions.

Why it matters

A config only names a server. This looks at what the agent will actually be told, and catches tools that impersonate or steer toward another server's tools.

Docs: poisoning.md

mcp-audit scan --check-vulns

What

Looks up known vulnerabilities in each server package and everything it depends on.

Why it matters

A server can be fine while a library under it is not.

Docs: supply-chain.md

mcp-audit scan --verify-hashes

What

Downloads each package and checks its fingerprint against a known-good one. mcp-audit verify does the same for a single package.

Why it matters

Detects a package that was swapped after it was published.

Docs: supply-chain.md

mcp-audit sast ./server-src

What

Scans the source code of an MCP server you're building or reviewing for injection, credential and auth bugs, with 91 Semgrep rules (47 Python, 44 TypeScript).

Why it matters

For people who write MCP servers, or review one before adopting it.

Docs: sast-rules.md

mcp-audit agent-files scan

What

Checks the other text your agent obeys: CLAUDE.md, AGENTS.md, skills, Cursor rules, Copilot instructions, Claude Code subagents and hooks.

Why it matters

Instructions don't only come from MCP servers. A poisoned skill or memory file works the same way.

Docs: agent-files.md

mcp-audit plugins scan

What

Inventories installed Claude Code plugins, flags ones that aren't pinned, and reviews mods that run code inside Claude Code.

Why it matters

Plugins bring servers, skills and code with them. This checks all three.

Docs: agent-files.md

mcp-audit extensions scan

What

Reviews the VS Code and Cursor extensions you have installed for known vulnerabilities, sideloaded files and risky permissions.

Why it matters

Your editor's extensions sit next to your agent with the same access.

Docs: extensions.md

mcp-audit dashboard

What

Opens an interactive map in your browser showing which servers can be chained into an attack.

Why it matters

Makes cross-server risk visible in one picture. Good for explaining it to others.

Docs: docs-usage.md

mcp-audit killchain

What

Names the three changes that would cut the most attack paths, and proves it by re-running the analysis without them.

Why it matters

Tells you where to start when there are too many findings to fix at once.

Docs: killchain.md

mcp-audit shadow

What

Finds every MCP server on a machine and sorts them into approved and unapproved (shadow) using your allowlist, with a risk level for each.

Why it matters

Security teams can't protect servers they don't know exist. OWASP lists this as MCP09.

Docs: shadow-mcp.md

mcp-audit merge --dir ./scans

What

Combines scan results from many machines into one report, with duplicates merged.

Why it matters

One view of MCP risk across a whole team or company.

Docs: fleet-scanning.md

mcp-audit push-nucleus --url … --project-id …

What

Sends findings into Nucleus Security, the same pipeline that handles findings from Qualys, Tenable and 200+ other tools.

Why it matters

MCP risk gets owners, deadlines and tracking like every other vulnerability.

Docs: nucleus-integration.md

mcp-audit snapshot --sign

What

Saves a time-stamped, optionally signed record of every server and finding on a machine.

Why it matters

After an incident you can show exactly what was installed and when.

Docs: snapshot.md

mcp-audit sbom

What

Produces a standard bill of materials listing every MCP server package and its dependencies.

Why it matters

Fits the supply-chain paperwork security and compliance teams already ask for.

Docs: supply-chain.md

mcp-audit feed verify <dir>

What

CVEs cover code bugs, not poisoned descriptions, risky combinations or malicious packages. mcp-audit publishes advisories for MCP risks as standard OSV records, signed every week.

Why it matters

Other scanners, registries and gateways can consume one shared, verifiable feed.

Docs: advisory-feed.md

mcp-audit scan --bundle <dir>

What

Copy a signed bundle of mcp-audit's data to a machine with no network and scan with it. mcp-audit refuses a bundle that is unsigned, expired or altered.

Why it matters

Current answers on machines that never touch the internet.

Docs: air-gapped.md

(every scan)

What

Reads tool descriptions for hidden orders: “read ~/.ssh/id_rsa”, “do not mention this to the user”, invisible Unicode text.

Why it matters

The core prompt-injection risk of MCP, caught before the agent reads it.

Docs: poisoning.md

(every scan)

What

Finds API keys and passwords pasted directly into configs.

Why it matters

Config files get synced, shared and committed. A pasted key travels with them.

Docs: docs-usage.md

(every scan)

What

Compares each package name with 56 known-legitimate servers and a mirror of known-malicious packages. mcp-audit update-registry refreshes the list.

Why it matters

One wrong letter in a package name can install an attacker's code.

Docs: supply-chain.md

(every scan)

What

Flags pairs of servers that are safe alone but dangerous together, like one that reads files and one that sends data to the internet.

Why it matters

Most real attacks need two abilities. This is the check almost nobody else does.

Docs: severity-framework.md

(every scan)

What

Flags servers reached over unencrypted http, remote servers with no authentication, servers run with sudo, and packages fetched fresh on every launch.

Why it matters

A remote server with no login is a door anyone can walk through: one study found 40.55% of 7,973 live remote MCP servers had none.

Docs: docs-usage.md

(every scan)

What

Remembers a fingerprint of every server's config and tells you when one changes between scans. mcp-audit pin records the current state as trusted.

Why it matters

Catches a server that was fine when you added it and changed later.

Docs: lock.md

(every scan)

What

Lists credential files on your machine an AI agent could read without asking you: SSH keys, cloud credentials, a project's .env.

Why it matters

Shows what a hijacked agent could take, and which deny rule would stop it.

Docs: secret-reach.md

(every scan)

What

If your company controls which MCP servers Claude Code may load, shows which of your servers that policy allows or blocks.

Why it matters

Admins and developers see the same answer to “is this server allowed here?”.

Docs: permission-rules.md

(every scan)

What

Reviews Claude Code permission rules and sandbox settings a repository could loosen, and hooks that send data out.

Why it matters

The agent's own safety switches are configuration too, and a repo can flip them.

Docs: permission-rules.md

mcp-audit scan

What

Every CVE finding says whether CISA lists it as exploited, its EPSS likelihood score and whether a public proof of concept exists. Exploited ones sort first.

Why it matters

Tells you which of many CVE findings to fix today.

Docs: exploit-signals.md