Repolode
Submit
apisec-inc

apisec-inc/mcp-audit

Scans AI dev tool configs (Claude Desktop, Cursor, VS Code) and MCP server source code for exposed secrets, API endpoints, AI models and code-level shell-injection risks.

View on GitHubWebsite
Stars
166
Forks
45
Open issues
6
Last commit
3 months ago

What is it?

MCP Audit inventories the Model Context Protocol servers configured in AI development tools such as Claude Desktop, Cursor, VS Code, Windsurf and Zed. It reports the secrets stored in those configs, the API endpoints each agent can reach, the AI models in use, and risk flags such as shell or filesystem access. Findings can be exported as JSON, CSV, Markdown, SARIF, or CycloneDX 1.6 AI-BOM files for compliance and supply-chain records.

A separate source-scan command reads the source code of MCP servers that import an MCP SDK and flags cases where LLM-controlled tool arguments flow into shell-spawning calls such as child_process.exec, subprocess.run(shell=True), os.system or os.popen. It supports table, JSON and SARIF output and an --exit-code flag for failing CI builds on critical findings.

The tool runs locally from the command line, with a browser-based web app for scanning GitHub repositories. It only inspects configuration files and MCP server source, so it does not cover secrets from runtime environments or external secrets managers.

Key features

  • 01Discovers MCP configs in Claude Desktop, Cursor, VS Code, Windsurf and Zed.
  • 02Detects 25+ secret patterns with provider-specific remediation advice.
  • 03Inventories API endpoints and AI models referenced by MCP servers.
  • 04Exports CycloneDX 1.6 AI-BOMs, SARIF, JSON, CSV and Markdown reports.
  • 05Scans MCP server source for shell-injection sinks fed by tool arguments.
  • 06Provides a --exit-code option for failing CI builds on critical findings.

Use cases

  • Checking which MCP servers and secrets developers have configured on their laptops.
  • Gating pull requests that add in-house MCP servers with shell-injection risks.
  • Producing an AI bill of materials for supply-chain or compliance reviews.
  • Uploading SARIF findings to GitHub code scanning for MCP server repositories.

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/apisec-inc/mcp-audit.git
  2. 2

    Enter the project directory and install with pip

    cd mcp-audit && pip install -e .
  3. 3

    Scan your machine for MCP configurations

    mcp-audit scan

Things to know

  • Requires Python 3.9 or newer.
  • Local CLI scans only config files, so secrets in runtime environment variables or secrets managers are not detected.

In collections

MCP servers

Topics

#agent-security#mcp#ai-security#secrets-detection#sbom#devsecops#supply-chain-security#ai#ai-bom#api-inventory

FAQ

What is mcp-audit?
Scans AI dev tool configs (Claude Desktop, Cursor, VS Code) and MCP server source code for exposed secrets, API endpoints, AI models and code-level shell-injection risks. MCP Audit inventories the Model Context Protocol servers configured in AI development tools such as Claude Desktop, Cursor, VS Code, Windsurf and Zed. It reports the secrets stored in those configs, the API endpoints each agent can reach, the AI models in use, and risk flags such as shell or filesystem access. Findings can be exported as JSON, CSV, Markdown, SARIF, or CycloneDX 1.6 AI-BOM files for compliance and supply-chain records.
Is mcp-audit free to use? What license does it have?
mcp-audit is open source under the MIT license. Check the license terms before using it in commercial products.
Is mcp-audit still maintained?
Updated within 6 months. The last commit to mcp-audit was on Aug 18, 2026.
What can I use mcp-audit for?
Checking which MCP servers and secrets developers have configured on their laptops. Gating pull requests that add in-house MCP servers with shell-injection risks. Producing an AI bill of materials for supply-chain or compliance reviews. Uploading SARIF findings to GitHub code scanning for MCP server repositories.
How do I install mcp-audit?
Clone the repository: git clone https://github.com/apisec-inc/mcp-audit.git Enter the project directory and install with pip: cd mcp-audit && pip install -e . Scan your machine for MCP configurations: mcp-audit scan
Where can I get mcp-audit?
The source code and installation instructions are on GitHub: https://github.com/apisec-inc/mcp-audit

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects