Three habits · mcp-audit Academy

1. Before you install a server

Run vet on the package name. Here is the real output for a one-letter typo of the official filesystem server:

$ mcp-audit vet @modelcontextprotocol/server-filesytem
╭────────────── Possible typosquat — vet exit 1 ──────────────╮
│   Queried:  @modelcontextprotocol/server-filesytem          │
│   Closest:  @modelcontextprotocol/server-filesystem         │
│             (maintainer: Anthropic, verified: True)         │
│   Distance: 1 edit(s)                                       │
│                                                             │
│   Did you mean the known-legitimate package above?          │
╰─────────────────────────────────────────────────────────────╯

Pre-install verdict

Before you install

mcp-audit vet <package>

What: Before you add a server, tells you if the name is known, whether it looks like a typo of a real package, its known CVEs and what it can do.
Why it matters: Catches look-alike and known-bad packages before they run on your machine.

Docs: vet.md

2. Before you trust a cloned repo

AI editors ask whether you trust a folder. Ask mcp-audit first.

Repo trust check

Before you trust a repo

mcp-audit scan --project ./cloned-repo

What: Walks a repository you just cloned and reports every MCP server and every file that would run code the moment you open the folder in your editor.
Why it matters: Run it before you click “Trust this folder”. That click is where repo-planted attacks start.

Docs: agent-execution-surface.md

3. Record what you approved

Once your setup is clean, lock it. Next time something changes, you'll know.

$ mcp-audit lock
$ git add mcp-lock.json && git commit -m "Lock approved MCP servers"
  …later, someone edits a server…
$ mcp-audit lock --verify
LOCK-001  Server drifted from lock: 'notion'
$ mcp-audit lock --accept     # after you've reviewed it

Lock approved servers

Team & CI

mcp-audit lock

What: Writes mcp-lock.json, a record of the servers you approved. Commit it. lock --verify fails if anything changes; lock --accept approves a reviewed change.
Why it matters: Turns “someone quietly changed a server” into a failed check in a pull request.

Docs: lock.md

Want it automatic? mcp-audit watch re-scans whenever a config changes, and the editor extension shows findings as you type.

Continuous watch

Day to day

mcp-audit watch

What: Keeps running and re-scans whenever an MCP config file changes.
Why it matters: You learn about a risky change when it happens, not next week.

Docs: docs-usage.md

Editor extension

Day to day

Open VSX: mcp-audit.mcp-audit-vscode

What: Shows mcp-audit findings as squiggles inside your MCP config files while you edit them. Install it from Open VSX in Cursor, Windsurf, VSCodium or any editor that uses Open VSX.
Why it matters: Security feedback where you already work, no terminal needed. Not yet on Microsoft's VS Code Marketplace; VS Code users can download the .vsix from the Open VSX page and choose “Install from VSIX”.

Docs: ide-extension.md

Am I affected?

Day to day

mcp-audit affected <CVE or package@range>

What: Give it an advisory ID or a package and version range, and it answers for every MCP server on the machine: affected, not affected, or couldn't check, with the evidence. --fix shows the pin that closes it; --format openvex writes a VEX document.
Why it matters: Turns “there's a new CVE in an agent tool” into a yes or no for your own setup in one command, and says what the server could reach if it was affected.

Docs: affected.md

Check yourself

1. You're about to add a server you found on a forum. First step?

2. When should you run scan --project?

3. What does lock --verify do when a server changed?