mcpaudit

allenwu-blip/mcpaudit

★ 4 stars JavaScript AI/LLM Updated today

Static pre-install security scanner for MCP (Model Context Protocol) servers — `npx mcpaudit <path>` flags command injection, credential/env exfiltration into LLM-visible output, over-broad filesystem/tool scope and dynamic eval before you wire a server into your agent.

View on GitHub → 🔍 Audit Wallet Slippage →

Quick Install

Copy the config for your editor. Some servers may need additional setup — check the README.

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mcpaudit": {
      "command": "npx",
      "args": [
        "-y",
        "allenwu-blip/mcpaudit"
      ]
    }
  }
}

README Excerpt

**A quick security X-ray for AI agent plugins, to run before you plug one in.** An MCP server (MCP = Model Context Protocol, the standard way to give an AI assistant new tools) is code you download and let an AI agent run. mcpaudit reads that code *before* you trust it and points out the dangerous bits — the

Tools (16)

MCP001MCP002MCP003MCP004MCP005MCP006MCP007MCP008MCP009MCP010MCP011MCP012MCP013MCP014pathValidatorstrustedPathVars

mcpaudit

Quick Install

README Excerpt

Tools (16)

Related AI/LLM Servers