graygnatconsole / mcp-audit-tool

# 🛡️ mcp-audit-tool
### The security audit CLI for Model Context Protocol (MCP) servers
**Scan your AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection, and supply-chain risks — before the model runs something you regret.**
Install · Quickstart · Rules · CI Integration · Roadmap
---
## 🔍 Why audit your MCP setup?
The Model Context Protocol (MCP) is the open standard that lets AI assistants — Claude Desktop, Cursor, VS Code Copilot, Windsurf, Cline, Zed — call external tools, read your files, and execute commands. Adoption exploded to **thousands of public MCP servers**, and security research keeps confirming the same story: **the MCP attack surface is real and largely unguarded.**
A single line in your `claude_desktop_config.json` or `.cursor/mcp.json` can hand an AI model:
- 🔑 **Your credentials** — API keys and tokens hardcoded in plaintext `env` blocks
- 📦 **Unpinned packages** — `npx -y some-mcp-server` fetches *whatever the latest release is*, every launch (the classic **rug pull**)
- 🐚 **Arbitrary execution** — `curl … | bash` installers and `bash -c` wrappers
- 🗂️ **Your whole disk** — filesystem servers rooted at `/` or `~`
- 🕳️ **Poisoned tool descriptions** — hidden instructions injected straight into the model's context (**tool poisoning**)
- 🌐 **Unauthenticated remote servers** — plaintext HTTP endpoints anyone can invoke
**`mcp-audit-tool` finds all of these in seconds.** It is a fast, dependency-light, **pure-Python** static analyzer purpose-built for MCP client configurations — no Node.js, no Docker, no LLM API keys required.
## ✨ Features
- 🧠 **12 built-in detection rules** covering the OWASP MCP Top 10 categories: tool poisoning, rug pulls, secrets exposure, command injection, installer spoofing, insecure transport, missing auth, permission creep
- 🔎 **Zero-config auto-discovery** — finds Claude Desktop, Cursor, Windsurf, Cline, Zed, and VS Code MCP configs on macOS, Linux, and Windows automatically
- 📊 **Security score & grade (A+ → F)** with clear, actionable remediation for every finding
- 🖥️ **Beautiful terminal reports** powered by Rich — plus machine-readable **JSON** and **SARIF 2.1.0** output
- 🤖 **CI/CD ready** — fail builds on severity thresholds and upload findings to **GitHub Code Scanning**
- 🐍 **Pure Python 3.9+** — three tiny dependencies (`typer`, `rich`, `pyyaml`), installs in seconds
- 🧩 **Extensible rule engine** — adding a new rule is one small function (see CONTRIBUTING)
## 🚀 Installation
### One-line installer (macOS & Linux)
 [code] 
The installer checks for Python 3.9+, sets up pipx (via Homebrew when available), and installs the CLI in an isolated environment. Done.
> **Fresh Mac?** You only need Apple's command line tools first:
> [code] 
> Everything else — Python, pipx, the tool itself — is handled by the one-liner above. **No Node.js or nvm required**: mcp-audit-tool is 100% Python.
### pipx (recommended, any platform)
 [code] 
### pip
 [code] 
### From source
 [code]