mcp-audit-tool - 🛡️ Security audit CLI for Model Context Protocol (

项目说明

<di="center">

🛡️ mcp-audit-tool

The security audit CLI for Model Context Protocol (MCP) servers

Scan your AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection, and supply-chain risks — before the model runs something you regret.

![CI]()
![PyPI]()
![Python]()
![SARIF]()

Install · Quickstart · Rules · CI Integration · Roadmap

</div>

---

🔍 Why audit your MCP setup?

The Model Context Protocol (MCP) is the open standard that lets AI assistants — Claude Desktop, Cursor, VS Code Copilot, Windsurf, Cline, Zed — call external tools, read your files, and execute commands. Adoption exploded to thousands of public MCP servers, and security research keeps confirming the same story: the MCP attack surface is real and largely unguarded.

A single line in your claude_desktop_config.json or .cursor/mcp.json can hand an AI model:

mcp-audit-tool finds all of these in seconds. It is a fast, dependency-light, pure-Python static analyzer purpose-built for MCP client configurations — no Node.js, no Docker, no LLM API keys required.

✨ Features

🚀 Installation

One-line installer (macOS & Linux)

The installer checks for Python 3.9+, sets up pipx ( when a), and installs the CLI in an isolated en. Done.

> Fresh Mac? You only need Apple's command line tools first:
>
> E else — Python, pipx, the tool itself — is handled by the one-liner above. No Node.js or n: mcp-audit-tool is 100% Python.

pipx (recommended, any platform)

pip

From source

⚡ Quickstart

Example output

🧭 Auto-discovered configs

| Client | macOS | Linux | Windows |
|---|---|---|---|
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json | ~/.config/Claude/… | %APPDATA%\Claude\… |
| Cursor | ~/.cursor/mcp.json | ✓ | ✓ |
| Windsurf | ~/.codeium/windsurf/mcp_config.json | — | — |
| Cline (VS Code) | …/globalStorage/saoudrizwan.claude-de/cline_mcp_settings.json | ✓ | ✓ |
| Zed | ~/.config/zed/settings.json | ✓ | — |
| Project-level | ./mcp.json, .cursor/mcp.json, .mcp.json, mcp.json | ✓ | ✓ |

🧪 Detection rules

| ID | Rule | Se | CWE |
|---|---|---|---|
| MAT-001 | Hardcoded secret in server env (OpenAI/Anthropic/GitHub/AWS/Slack/Google keys, private keys) | 🔴 CRITICAL | CWE-798 |
| MAT-002 | Sensitive host env through to the ser | 🔴 HIGH | CWE-200 |
| MAT-003 | Unpinned npx/uvx/pipx package — rug-pull & supply-chain risk | 🔴 HIGH | CWE-1357 |
| MAT-004 | curl/wget piped to shell — installer spoofing / RCE | 🔴 CRITICAL | CWE-494 |
| MAT-005 | Dangerous launch commands (rm -rf, sudo, chmod 777, eval) | 🔴 HIGH | CWE-78 |
| MAT-006 | Shell -c wrapper — command-injection surface | 🟡 MEDIUM | CWE-78 |
| MAT-007 | Filesystem ser at /, ~, or $HOME | 🔴 HIGH | CWE-22 |
| MAT-008 | Remote MCP server o HTTP | 🔴 HIGH | CWE-319 |
| MAT-009 | Remote MCP server with no authentication configured | 🟡 MEDIUM | CWE-306 |
| MAT-010 | Tool-poisoning indicators in descriptions (hidden instructions) | 🔴 CRITICAL | CWE-74 |
| MAT-011 | Destructi on the auto-approve list (no human confirmation) | 🟡 MEDIUM | CWE-862 |
| MAT-012 | Wildcard * permissions | 🟡 MEDIUM | CWE-732 |

🤖 GitHub Actions & CI

Gate pull requests on MCP config security and surface findings in the Security tab:

Exit codes

| Code | Meaning |
|---|---|
| 0 | Scan completed; no finding at or above --fail-on threshold |
| 1 | Findings at or above the --fail-on se |
| 2 | Usage error (missing file, parse error, bad options) |

🗺️ Roadmap

Contributions welcome — see CONTRIBUTING.md.

🤝 Related projects

Part of a growing MCP security ecosystem — also check out:

📄 License

MIT © GrayGnatConsole — use it, fork it, ship it.

---

<di="center">

If mcp-audit-tool caught something nasty in your config, ⭐ star the repo — it helps others find it too.

mcp security · model context protocol audit · mcp scanner · mcp scanner · ai agent security · llm security tool · tool poisoning detection · mcp rug pull · claude desktop security · cursor mcp security · supply chain security ai · prompt injection scanner · sarif security scanner · de ai agents

</div>

项目信息

开发语言：Python

Star 数：101

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。