mcp-audit GitHub

Part 3 · How · 2 min

Your first 15 minutes

Install, get a grade, fix the easy things, and look at the full list.

  1. Install

    You need Python 3.11 or newer. The package is called mcp-audit-scanner; the command it installs is mcp-audit.

    $ pip install mcp-audit-scanner
$ mcp-audit version

    On a Mac, if pip fails with “bad interpreter”, use python3 -m pip install mcp-audit-scanner. If mcp-audit isn't found afterwards, Python's bin folder isn't on your PATH; the README's macOS notes show the one-line fix. Standalone binaries that need no Python are on the Releases page.

  2. See what you have

    $ mcp-audit discover

    Most people find more servers than they expected, including ones added by plugins.

  3. Get your grade

    $ mcp-audit check

    A or B with nothing HIGH or CRITICAL means you're in good shape. Anything else, read the top five and their hints.

  4. Preview the safe fixes, then apply them

    $ mcp-audit fix            # shows the changes, writes nothing
$ mcp-audit fix --apply    # writes them, keeps a .bak copy

    When fix moves a secret out of your config, it puts a placeholder like ${GITHUB_TOKEN} in its place. Set that environment variable where your AI client can see it.

  5. Read the full list

    $ mcp-audit scan
$ mcp-audit check            # again, to see the new grade
Tip for vibe codersPaste a finding into your AI assistant and ask “explain this and how to fix it in my setup.” mcp-audit redacts secrets in its evidence, but read what you paste before you send it.

One-command verdict

Get started

mcp-audit check

What
Scans every MCP config on your machine and prints a letter grade, a 0–100 score, your top five issues and a fix hint for each.
Why it matters
You get an answer in seconds without reading a long report. Start here.

Docs: check.md

Safe auto-fix

Get started

mcp-audit fix --apply

What
Rewrites your config to fix the safe, mechanical problems: moves pasted secrets to environment variables, upgrades http:// to https://, replaces a look-alike package with the real one.
Why it matters
Fixes the common mistakes without you editing JSON by hand.

Docs: fix.md

Under the hood: install options and offline behaviour

uv add mcp-audit-scanner also works. Extras: [mcp] for --connect, [attestation] for Sigstore. Standalone binaries are PyInstaller builds (about ten seconds of silent startup) and each release attaches a CycloneDX SBOM per binary.

scan is offline. check is offline unless you have run mcp-audit register, after which each run sends a short ping with the grade. fix, sbom and lock look up package versions online unless you pass --offline. Full list: docs/privacy.md.

Check yourself

1. What's the pip package name?

2. What does mcp-audit fix do without --apply?

3. After fix moves a token to ${GITHUB_TOKEN}, what must you do?