mcp-audit

Security scanner and linter for Model Context Protocol (MCP) servers. Like npm audit and eslint, but for the tools you hand your AI agents.

npm: https://www.npmjs.com/package/@royalpinto007/mcp-audit

npm install -g @royalpinto007/mcp-audit
# or run it directly
npx @royalpinto007/mcp-audit stdio "node my-mcp-server.js"

Why

MCP servers give language models real capabilities: run commands, read files, hit internal URLs, mutate databases. A single over-scoped tool or a .env exposed as a resource turns a helpful agent into a remote code execution or data-exfiltration path. Yet most MCP servers ship with no security review at all.

mcp-audit connects to an MCP server (or lints its manifest), enumerates every tool, resource, and prompt, and runs a catalog of security rules over that surface. It finds the dangerous stuff before your agent does:

• arbitrary command / shell execution tools,
• destructive actions with no confirmation or scoping,
• prompt-injection sinks planted in tool descriptions,
• secrets and system paths exposed as resources,
• SSRF-prone URL arguments and unauthenticated HTTP transports,
• unconstrained input schemas that let the model pass anything, anywhere.

It runs offline, is fully deterministic, and drops straight into CI with JSON and SARIF output for GitHub code scanning.

Quickstart

# Audit a server you spawn over stdio
npx @royalpinto007/mcp-audit stdio "node my-mcp-server.js"

# Audit a remote server over HTTP (with a bearer token)
npx @royalpinto007/mcp-audit http https://mcp.example.com/mcp --token "$MCP_TOKEN"

# Lint a server's declared surface from a manifest, without running it
npx @royalpinto007/mcp-audit static ./mcp-manifest.json

# List every built-in rule
npx @royalpinto007/mcp-audit rules

Example output

mcp-audit — stdio target node my-mcp-server.js
server: insecure-demo-server v0.0.0-internal
surface: 5 tools, 2 resources, 1 prompts

 CRITICAL   (3)
  ✖ MCP002 Arbitrary execution tool detected  @ run_shell
      Tool "run_shell" appears to execute commands or code (matched "shell").
      fix: Avoid exposing raw exec. If unavoidable, allowlist commands, drop privileges, sandbox execution, and require human approval.
  ✖ MCP030 Resource surfaces sensitive material  @ file:///home/app/.env
      Resource "file:///home/app/.env" references ".env", which commonly holds secrets or system credentials.
      fix: Remove the resource or restrict it to non-sensitive content.

 HIGH  (4)