MCP Audit CLI
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
- 165 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Reads agent configs that hold tokens and finds plaintext secrets; results are saved to reports that need careful handling.
Install
- Works in
Manual install
pip install -e .The README quick-start command: run it in a repository clone, Python 3.9+ is required.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads agent configs that hold tokens and finds plaintext secrets; results are saved to reports that need careful handling.
This is third-party code. Review the repository files before installing.
What it does
MCP Audit walks the MCP server configurations in Claude Desktop, Cursor, VS Code, Windsurf and Zed and shows what your agents can reach. `mcp-audit scan` finds secrets by 25-plus patterns (GitHub tokens, database connection strings, AWS and Stripe keys), lists connected endpoints and models and flags dangerous capabilities: shell, filesystem writes, unverified sources. Each finding gets a level from LOW to CRITICAL and a remediation hint. `mcp-audit source-scan` goes deeper and reads the MCP server's own source code. It currently catches the chain where a model-controlled tool argument reaches a shell launch (`child_process.exec`, `subprocess.run(shell=True)`, `os.system`). Results come as a table, JSON, SARIF for GitHub code scanning, CSV, Markdown or a CycloneDX 1.6 bill of materials (AI-BOM). A `--exit-code` flag serves CI. A web version also scans GitHub repositories in the browser.
Who it is for. Security engineers and developers whose Claude Desktop or Cursor has collected a dozen MCP servers with tokens in their configs.
Good fit when
- `claude_desktop_config.json` holds GitHub tokens and database connection strings and you want to know what sits in plain text.
- Before releasing your own MCP server you check that it does not pass tool arguments straight to a shell.
- CI must fail when an MCP configuration with critical access is committed to a repository.
- An organization needs an inventory of MCP servers and connected models as an AI-BOM for an audit.
- A security report goes to GitHub Security through SARIF.
Not a fit when
- Secrets live in a secrets manager or are assembled at runtime: the scanner reads only config files.
- You need real-time protection of a running agent: this is a static check with no runtime monitoring.
- You want bugs in arbitrary code: `source-scan` deliberately opens only MCP server files and looks for one chain.
Example request
Run `mcp-audit scan --secrets-only` on my machine, show the critical findings without secret values and tell me which tokens to reissue.Limitations
A clean result does not mean zero threats: the scanner cannot see runtime environment-variable secrets, configs from secrets managers, dynamically generated configs, MCPs installed but not configured, or non-standard paths. GitHub scanning is limited by your token's scope. The README install runs from a repository clone (`pip install -e .`) and needs Python 3.9+. `source-scan` checks JS, TS and Python and looks only for shell injection. An emailed report (`--email`) sends a summary without secrets. The latest commit in the repository is from August 2026.
How to disable. Remove the package with `pip uninstall mcp-audit` and the repository clone. Reports (`report.json`, `results.sarif`) may contain paths and finding details, so clean them up separately.
FAQ
How do I install MCP Audit?
Clone the repository and run `pip install -e .` in its folder, then check `mcp-audit --help`. A Docker image is also available: `docker build -t mcp-audit .`. A no-install version runs in the browser at `apisec-inc.github.io/mcp-audit`.
Which configurations are scanned?
Claude Desktop, Cursor, VS Code, Windsurf and Zed on your machine, plus files such as `mcp.json` and `claude_desktop_config.json` committed to GitHub repositories. Point at another folder with `--path`.
What does source-scan do?
It reads MCP server source in JS, TS and Python and finds places where a tool argument reaches a shell launch unsanitized. A critical finding can fail CI with the `--exit-code` flag.
How do I send results to GitHub Security?
Produce SARIF: `mcp-audit scan --format sarif -o results.sarif` or `mcp-audit source-scan ./my-mcp --format sarif --output mcp.sarif`. Upload the file to code scanning, for example with the `github/codeql-action/upload-sarif` action.
Do my secrets leave the machine?
The CLI runs fully locally with no telemetry. In the web version the GitHub token stays in the browser, and the emailed PDF report holds only a summary without secrets.
Discussion
No questions or reviews yet.
Related
CLI toolsSecurity scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A repository scanner with an MCP server: dependency graph, secrets, vulnerabilities and an API map with code line citations
README in short
The README opens with a quick start and sample output, then describes source scanning, blind spots, CI integration, export formats and tables of severity levels and secret types. It ends with release checksum verification.