Skip to content

Back to the catalog

graygnatconsole/mcp-audit-tool
github.comrepo

graygnatconsole/mcp-audit-tool

mcp-audit-tool is a dependency-light Python CLI that statically scans Claude Desktop, Cursor, Windsurf, Cline, Zed, and VS Code MCP configuration files for security issues, including hardcoded secrets, unpinned/rug-pull packages, pipe-to-shell installers, tool-poisoning via hidden instructions in tool descriptions, filesystem servers rooted at '/', and unauthenticated plaintext HTTP MCP endpoints. It auto-discovers configs across macOS/Linux/Windows, produces a security score/grade plus SARIF 2.1.0 output for GitHub Code Scanning, and is built around the OWASP MCP Top 10 categories with a CI/CD example that fails builds on severity thresholds. The roadmap adds live server probing over stdio/SSE for runtime rug-pull detection and an ML-based prompt-injection classifier for tool descriptions.

TL;DR Pure-Python static scanner that audits MCP client configs (Claude Desktop, Cursor, etc.) for tool poisoning, rug pulls, hardcoded secrets, command injection, and insecure transport, with SARIF/CI integration.
Open original ↗
Document

What it is

mcp-audit-tool (MIT, GrayGnatConsole) — a pure-Python 3.9+ static analyzer for MCP client configs. The summary already covers the scope, detection categories, scoring, SARIF, and roadmap. What it omits is the actual invocation surface and one install quirk worth knowing before you run it.

What to do

Install (the README's own primary one-liner):

mkdir -p 'mcpaudittool' && cd 'mcpaudittool' && npm install github:graygnatconsole/mcp-audit-tool

Or the Python-native paths:

pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git
pip install git+https://github.com/graygnatconsole/mcp-audit-tool.git

Core usage:

mcp-audit scan                                 # auto-discover every config
mcp-audit scan ~/.cursor/mcp.json              # one file
mcp-audit scan --format sarif --output results.sarif
mcp-audit scan --fail-on high                  # exit code 1 on HIGH or worse
mcp-audit rules                                # list all detection rules

There are 12 rules with stable IDs (MAT-001 … MAT-010+), so you can suppress or gate on specific ones: MAT-001 hardcoded secret, MAT-003 unpinned package/rug-pull, MAT-004 pipe-to-shell installer, MAT-007 filesystem rooted at /, MAT-008 plaintext HTTP, MAT-010 tool poisoning (hidden instruction). Each finding ships remediation text (e.g., MAT-004: "Download the script, review it, pin its checksum, execute a local copy").

CI gating uses --fail-on <severity> plus github/codeql-action/upload-sarif@v3; the workflow needs permissions: security-events: write.

Caveats

  • The advertised install one-liner runs npm install github:... — Node's npm — despite the tool's headline claim of "no Node.js required, 100% Python." If you're avoiding a Node toolchain, use the pipx/pip paths instead; the npm route only shells out to a Python installer.
  • Detection is static only. Runtime rug-pull detection (live tools/list probing over stdio/SSE with hash diffing), the ML prompt-injection classifier, mcp-audit fix, and --baseline drift mode are all roadmap, not shipped — so a config that passes can still pull a malicious tool at launch.
  • The README points to adjacent tools that cover the runtime gap: invariantlabs/mcp-scan (runtime proxy) and the CSA ModelContextProtocol-Security/mcpserver-audit (server-source auditing).

Technologies named here

Techniques named here

Related in AI Security