Part 2 · What · 2 min
What mcp-audit is
An offline security scanner and committable lock for the MCP servers your AI coding tools run.
Five principles
A plain scan makes no network calls. Lookups that need the internet are flags you choose.
No telemetry. Secret values are redacted in output and never written to the lock file.
Apache 2.0. No paid tier, no license keys, every feature in every install.
It publishes its own detection rates and false positives, including the weak spots.
CLI, an editor extension for Cursor and other Open VSX editors, a GitHub Action, a pre-commit hook, 10 AI clients.
What it reads
- MCP configs for Claude Desktop, Cursor, VS Code, Windsurf, Claude Code, GitHub Copilot CLI, Augment Code, Amazon Q Developer, Codex and Gemini CLI, at user level and inside repositories.
- Agent instruction files: CLAUDE.md, AGENTS.md, skills, rules, subagents, hooks.
- Agent settings: permission rules, sandbox settings, managed company policy.
- Things around the agent: Claude Code plugins, editor extensions, GitHub Actions workflows that run AI agents, MCP gateways.
- Optionally, live servers, to see the tools they really offer.
What it gives back
A grade from A to F with a 0–100 score, and a list of findings. Each finding has an ID, a severity, the server it's about, the evidence, an OWASP MCP Top 10 code and a hint for fixing it.
| Severity | What it means for you |
|---|---|
| CRITICAL | Likely exploitable now. Stop and fix it. |
| HIGH | A serious weakness. Fix it before you rely on this setup. |
| MEDIUM | A real risk in some situations. Plan to fix it. |
| LOW | Worth tidying up. |
| INFO | Context, not a problem. For example, “first scan, baseline recorded”. |
What it is not
It does not sit between your agent and its tools at runtime, and it can't block a call in progress. That is a choice, not a gap. Runtime firewalls and gateways are their own product category, mostly commercial; mcp-audit is the free, offline layer you run before and around them, and it works the same whether or not you use one. It can't prove a server is safe; it shows you evidence. It doesn't run your servers unless you ask it to with --connect.
Under the hood: finding ID families
| Prefix | Covers |
|---|---|
POISON- | Hidden instructions in tool descriptions and agent files; hidden-text channels |
CRED- | Plaintext secrets |
TRANSPORT- AUTH- | Unencrypted transport, privilege, runtime fetching; missing or weak auth |
SC- VULN- ATTEST- | Typosquats, known CVEs, malicious packages; dependency CVEs; hash/signature checks |
TOXIC- INTEG- | Cross-server confidentiality and integrity pairs |
RUGPULL- LOCK- INSTR- | Change detection across scans; lock drift; changed instruction files |
TRUST- | Repo-planted servers and auto-run files; symlinks |
CFHYG- HARNESS- PERM- SANDBOX- HOOK- | Config hygiene and agent settings posture |
SKILL- MEM- AGENT- | Skills, memory files, subagent definitions |
PLUGIN- MOD- | Claude Code plugins and mods |
REACH- MANAGED- | Reachable credential files; managed MCP policy |
COLLIDE- DELEG- | Live-only: tool-name collisions, cross-tool delegation |
COMM- STDIO- GOV- | Community rules; your governance policy |
WORKFLOW- | GitHub Actions workflows that run an AI agent with secrets |
Exit codes everywhere: 0 clean, 1 findings, 2 error.
Check yourself
1. Does a plain mcp-audit scan send your config to a server?
Core scanning works fully offline. There is also no paid tier.
2. A finding marked INFO usually means…
INFO findings record facts, such as the first baseline being saved.
3. Which is mcp-audit NOT?
It inspects configuration and supply chain. It isn't in the path of live tool calls.