** 代码审计工具，能发现 MCP 服务器和 Claude 桌面扩展的安全漏洞——因为任何人都能构建，但并非所有人都能安全构建。**

为什么这个工具存在

任何人都可以创建MCP服务器和桌面扩展——不需要编程经验。简单程度如下：

示例：构建桌面扩展（无需编程）

正如Anthropic在其官方博客文章中所述：

“在Anthropic内部，我们发现Claude非常适合以最少干预的方式构建扩展。如果你也想使用Claude代码，我们建议你简要说明你希望扩展做什么，然后在提示中添加以下上下文：

只需将此内容粘贴到Claude或任何AI助手中：

**AI会帮你写整个扩展。**不需要编程知识。

问题：建造容易，安全建造困难

由于任何人都可以通过请求AI助手来创建这些工具，我们看到MCP服务器和扩展的爆炸式增长。但许多都构建得很差，甚至可能有危险：

• 安全漏洞 - AI生成的代码常常存在安全漏洞

MCP Server Audit

Code audit tool that finds security vulnerabilities in MCP servers and Claude Desktop Extensions - because anyone can build them, but not everyone builds them safely.

Why This Tool Exists

Anyone can create MCP servers and Desktop Extensions - no programming experience required. Here’s how easy it is:

Example: Building a Desktop Extension (No Programming Needed)

As Anthropic states in their official blog post:

“Internally at Anthropic, we have found that Claude is great at building extensions with minimal intervention. If you too want to use Claude Code, we recommend that you briefly explain what you want your extension to do and then add the following context to the prompt:”

Simply paste this into Claude or any AI assistant:

I want to build this as a Desktop Extension, abbreviated as "DXT". Please follow these steps:

1. **Read the specifications thoroughly:**
   - https://github.com/anthropics/dxt/blob/main/README.md - DXT architecture overview, capabilities, and integration patterns
   - https://github.com/anthropics/dxt/blob/main/MANIFEST.md - Complete extension manifest structure and field definitions
   - https://github.com/anthropics/dxt/tree/main/examples - Reference implementations including a "Hello World" example

2. **Create a proper extension structure:**
   - Generate a valid manifest.json following the MANIFEST.md spec
   - Implement an MCP server using @modelcontextprotocol/sdk with proper tool definitions
   - Include proper error handling and timeout management

3. **Follow best development practices:**
   - Implement proper MCP protocol communication via stdio transport
   - Structure tools with clear schemas, validation, and consistent JSON responses
   - Make use of the fact that this extension will be running locally
   - Add appropriate logging and debugging capabilities
   - Include proper documentation and setup instructions

4. **Test considerations:**
   - Validate that all tool calls return properly structured responses
   - Verify manifest loads correctly and host integration works

Generate complete, production-ready code that can be immediately tested. Focus on defensive programming, clear error messages, and following the exact DXT specifications to ensure compatibility with the ecosystem.

The AI will write the entire extension for you. No coding knowledge required.

The Problem: Easy to Build, Hard to Build Safely

Since anyone can create these tools by asking AI assistants, we’re seeing an explosion of MCP servers and extensions. But many are poorly built and potentially dangerous:

• Security vulnerabilities - AI-generated code often has security holes
• Data exposure risks - Tools may leak sensitive information
• Poor quality - Many tools break, perform poorly, or aren’t maintained
• Unknown trustworthiness - Hard to tell which tools are safe to use