在AI代理上线前，先看看他们能访问什么。

网页应用

CLI

快速启动

它的作用

MCP Audit 会扫描您的 AI 开发工具（Claude Desktop、Cursor、VS Code），并揭示：

• 秘密 - 暴露的API密钥、令牌、数据库密码
• API - 你的AI代理连接的每一个端点
• AI模型 - 配置了哪些大型语言模型（GPT-4、Claude、Llama）
• 风险标志 - 壳层访问、文件系统访问、未验证来源

源级扫描（v1.1 新增）

mcp-audit scan 清单 MCP 服务器 配置。新的 mcp-audit source-scan 命令更进一步——读取 MCP 服务器自身的 源代码，并标记服务器作者可能引入的代码级漏洞。

如今它捕获了**“提示输入，壳出”**攻击链：一个MCP服务器，将LLM控制的工具参数导入壳生成API（child_process.exec、util.promisify(exec)、subprocess.run(shell=True)、os.system、os.popen），且不进行净化。控制LLM输入的攻击者可以在运行MCP服务器的主机上注入shell元字符并执行任意代码。

输出：

MCP Audit

See what your AI agents can access - before they go live.

Web App

CLI

Quick Start

# Install
pip install -e .

# Scan your machine
mcp-audit scan

# Or try the web app (no install)
# https://apisec-inc.github.io/mcp-audit/?demo=true

What It Does

MCP Audit scans your AI development tools (Claude Desktop, Cursor, VS Code) and reveals:

• Secrets - Exposed API keys, tokens, database passwords
• APIs - Every endpoint your AI agents connect to
• AI Models - Which LLMs are configured (GPT-4, Claude, Llama)
• Risk Flags - Shell access, filesystem access, unverified sources

⚠️  2 SECRET(S) DETECTED - IMMEDIATE ACTION REQUIRED

[CRITICAL] GitHub Personal Access Token
  Location: github-tools → env.GITHUB_TOKEN
  Remediation: https://github.com/settings/tokens → Delete → Recreate

[HIGH] Database Connection String
  Location: postgres-mcp → env.DATABASE_URL
  Remediation: Rotate credentials, use secrets manager

Source-level Scanning (new in v1.1)

mcp-audit scan inventories MCP server configurations. The new mcp-audit source-scan command goes one level deeper — it reads the MCP server’s own source code and flags code-level vulnerabilities the server author may have introduced.

Today it catches the “Prompt In, Shell Out” attack chain: an MCP server that pipes an LLM-controlled tool argument into a shell-spawning API (child_process.exec, util.promisify(exec), subprocess.run(shell=True), os.system, os.popen) without sanitization. An attacker controlling the LLM input can inject shell metacharacters and execute arbitrary code on the host running the MCP server.

$ mcp-audit source-scan ./packages/my-mcp-server

MCP source-scan: packages/my-mcp-server
1 critical · 0 high · 1 finding(s) total

  Severity  Conf  File:Line      API                                          Snippet
  CRITICAL  high  server.js:19   util.promisify(child_process.exec) ...       const { stdout } = await execAsync(

Outputs:

• --format table (default, human-readable)
• --format json (CI integrations, jq pipelines)
• --format sarif (upload to GitHub code-scanning / GitLab / similar)

Gate merges on critical findings:

mcp-audit source-scan ./my-mcp --exit-code

The scanner is intentionally narrow — it only opens files that look like MCP server source (imports an MCP SDK). It won’t try to find shell-injection bugs in random Node / Python code; that’s not the job.