Skip to main content
Glama
Shen-zhihao

mcp-web-audit

by Shen-zhihao
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

mcp-web-audit

一个基于 Node.js 的前端工程安全审计工具，支持对本地项目和远程仓库进行全面的依赖安全审计。

🔍 功能特性

  • 🛡️ 全面审计: 审计前端工程的所有直接和间接依赖

  • 🌐 多源支持: 支持本地工程和远程仓库（GitHub 等）的审计

  • 📊 详细报告: 生成标准格式的 Markdown 审计报告

  • 🔌 MCP 集成: 作为 MCP (Model Context Protocol) 服务器提供审计服务

  • ⚡ 自动化: 全自动化的审计流程，无需手动干预

  • 🚀 CLI 支持: 支持通过 npx 直接调用，无需安装

Related MCP server: Dependency Checker MCP Server

📋 审计内容

  • 漏洞检测: 识别依赖包中的已知安全漏洞

  • 版本分析: 检查依赖包版本的安全性和兼容性

  • 依赖链分析: 深入分析间接依赖关系

  • 风险评估: 按严重程度分类漏洞（Critical、High、Moderate、Low）

  • 修复建议: 提供具体的修复方案和建议

🚀 快速开始

使用 npx (推荐)

无需安装，直接使用：

# 审计本地项目
npx mcp-web-audit /path/to/your/project

# 审计远程仓库
npx mcp-web-audit https://github.com/user/repo

# 指定输出文件
npx mcp-web-audit /path/to/project -o ./my-audit.md

# 查看帮助
npx mcp-web-audit --help

# 查看版本
npx mcp-web-audit --version

全局安装

# 全局安装
npm install -g mcp-web-audit

# 使用命令
mcp-web-audit /path/to/your/project

本地安装开发版本

# 克隆仓库
git clone https://github.com/shenzhihao/mcp-web-audit.git
cd mcp-web-audit

# 安装依赖
npm install

# 本地测试
node bin/cli.js /path/to/test/project

🚀 CLI 使用说明

基本用法

npx mcp-web-audit [options] <项目路径>

参数说明

  • <项目路径>: 要审计的项目路径（本地绝对路径或远程仓库 URL）

选项

  • -o, --output <文件>: 指定输出报告的文件路径 (默认: ./audit-report.md)

  • -h, --help: 显示帮助信息

  • -v, --version: 显示版本信息

使用示例

# 审计当前目录
npx mcp-web-audit .

# 审计指定本地项目
npx mcp-web-audit /Users/username/my-project

# 审计GitHub仓库
npx mcp-web-audit https://github.com/facebook/react

# 指定输出文件名
npx mcp-web-audit ./my-project -o security-report.md

# 查看帮助信息
npx mcp-web-audit --help

作为 MCP 服务器运行

作为 MCP 服务器运行

node src/mcpServer.js

编程式调用

import { auditPackage } from "mcp-web-audit";

// 审计本地项目
await auditPackage("/path/to/your/project", "./audit-report.md");

// 审计远程仓库
await auditPackage("https://github.com/user/repo", "./audit-report.md");

📊 审计报告示例

生成的审计报告包含以下信息：

  • 项目概述: 项目名称、版本等基本信息

  • 漏洞汇总: 按严重程度统计的漏洞数量

  • 详细漏洞列表: 每个漏洞的详细信息，包括：

    • 漏洞描述

    • 影响的包和版本

    • 严重程度评级

    • 修复建议

    • 相关链接

📝 要求

  • Node.js: >= 14.0.0

  • 网络: 审计远程仓库时需要网络连接

  • 磁盘空间: 至少 100MB 空闲空间（用于临时文件）

📁 项目结构

src/
├── audit/              # 审计核心模块
│   ├── currentAudit.js  # 当前项目审计
│   ├── getDepChain.js   # 依赖链分析
│   ├── index.js         # 审计主入口
│   ├── normalizeAuditResult.js  # 结果标准化
│   ├── npmAudit.js      # NPM 审计
│   └── remoteAudit.js   # 远程审计
├── common/             # 通用工具
│   └── utils.js        # 工具函数
├── entry/              # 程序入口
│   └── index.js        # 主要 API 入口
├── generateLock/       # Lock 文件生成
│   ├── generateLock.js # Lock 文件生成逻辑
│   └── index.js        # 模块入口
├── main/               # 主程序
│   └── index.js        # 主程序入口
├── parseProject/       # 项目解析
│   ├── index.js        # 解析入口
│   ├── parseLocalProject.js   # 本地项目解析
│   └── parseRemoteProject.js  # 远程项目解析
├── render/             # 报告渲染
│   ├── index.js        # 渲染入口
│   ├── markdown.js     # Markdown 渲染
│   └── test/           # 测试文件
├── workDir/            # 工作目录管理
│   └── index.js        # 工作目录操作
└── mcpServer.js        # MCP 服务器

🔧 API 参考

auditPackage(projectRoot, savePath)

审计指定项目的所有依赖包。

参数:

  • projectRoot (string): 项目根目录的绝对路径或远程仓库 URL

  • savePath (string): 审计报告保存路径

示例:

// 本地项目
await auditPackage("/Users/username/my-project", "./audit.md");

// 远程仓库
await auditPackage("https://github.com/facebook/react", "./react-audit.md");

📊 审计报告

生成的审计报告包含以下信息：

  • 项目概述: 项目名称、版本等基本信息

  • 漏洞汇总: 按严重程度统计的漏洞数量

  • 详细漏洞列表: 每个漏洞的详细信息，包括：

    • 漏洞描述

    • 影响的包和版本

    • 严重程度评级

    • 修复建议

    • 相关链接

🛠️ 技术栈

  • 运行环境: Node.js (ES Modules)

  • 核心依赖:

    • @modelcontextprotocol/sdk: MCP 协议支持

    • ejs: 模板引擎

    • zod: 数据验证

🔒 安全审计流程

  1. 项目解析: 解析项目的 package.json 文件

  2. 依赖分析: 分析所有直接和间接依赖

  3. Lock 文件生成: 生成依赖锁定文件

  4. 安全扫描: 使用 npm audit 进行安全扫描

  5. 结果标准化: 将审计结果标准化处理

  6. 报告生成: 生成 Markdown 格式的审计报告

🤝 贡献指南

欢迎提交 Issue 和 Pull Request 来帮助改进这个项目。

📄 许可证

ISC License

📞 支持

如果您在使用过程中遇到问题，请提交 Issue 或联系维护者。

Available Tools

1 tool
auditPackage审计前端工程B

审计前端工程的所有直接和间接依赖，得到安全审计结果。支持本地工程的审计，也支持远程仓库的审计。审计结果为标准格式的markdown字符串，不用修改，直接用于展示即可。

ParametersJSON Schema
NameRequiredDescriptionDefault
projectRootYes本地工程的根路径，或者远程仓库的URL地址
savePathYes保存审计结果的路径，传递当前工程的根路径下的工程明audit.md，如果没有当前工程，则传递桌面路径下的audit.md（注意，桌面路径必须传入绝对路径）

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the audit result is '标准格式的markdown字符串' (standard format markdown string) and should be used directly for display without modification, adding useful behavioral context. However, it doesn't cover other critical aspects like required permissions, rate limits, error handling, or whether the operation is read-only or mutative. The description adds some value but leaves significant gaps for a tool performing security audits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise with two sentences that efficiently cover purpose, scope, and output usage. It's front-loaded with the core function, and each sentence adds value without redundancy. A minor deduction for slightly awkward phrasing in the second sentence, but overall it's well-structured and waste-free.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (security auditing with 2 parameters) and no annotations or output schema, the description is moderately complete. It explains what the tool does, the types of inputs (local/remote), and output format, but lacks details on behavioral traits like safety, permissions, or error handling. Without an output schema, it should ideally describe return values more thoroughly, but the markdown format note provides some compensation. It's adequate but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both parameters well-documented in the schema. The description doesn't add any parameter-specific information beyond what's in the schema (e.g., it doesn't explain 'projectRoot' or 'savePath' further). According to the rules, when schema coverage is high (>80%), the baseline is 3 even with no param info in the description, which applies here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: '审计前端工程的所有直接和间接依赖，得到安全审计结果' (audits all direct and indirect dependencies of a frontend project to obtain security audit results). It specifies the verb ('审计' - audit) and resource ('前端工程' - frontend project) with scope ('所有直接和间接依赖' - all direct and indirect dependencies). However, with no sibling tools provided, it cannot demonstrate differentiation from alternatives, preventing a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating '支持本地工程的审计，也支持远程仓库的审计' (supports auditing local projects and remote repositories), which suggests when to use it based on project location. However, it lacks explicit guidance on when not to use it or alternatives, and no prerequisites are mentioned. With no sibling tools, comparative guidance isn't applicable, but the implicit context is sufficient for a baseline score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • First observedauditPackage
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.4/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of ambiguity or overlap between tools. The single tool 'auditPackage' has a clearly defined and distinct purpose focused on auditing dependencies.

Naming Consistency5/5

Since there is only one tool, naming consistency is inherently perfect. The tool name 'auditPackage' follows a clear verb_noun pattern, which would be consistent if more tools were added.

Tool Count2/5

A single tool is too few for a server named 'mcp-web-audit', which suggests a broader scope for web auditing. The tool only covers dependency auditing, leaving gaps for other potential web audit functions like performance checks or accessibility testing.

Completeness2/5

The tool set is severely incomplete for the inferred domain of web auditing. It only provides dependency auditing, missing obvious operations such as security scanning, performance analysis, or compliance checks, which are typical in web audit workflows.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Dependency Checker MCP Server

    djodjonx
    A
    license
    B
    quality
    C
    maintenance
    Enables security scanning for npm dependencies by checking manifest and lockfiles against the OSV.dev and Socket.dev vulnerability databases. It provides tools to detect vulnerabilities in specific packages and retrieve detailed technical reports for identified security issues.
    3
    15 npm
    MIT

  • VibeCheck MCP Server

    BPN-Solutions
    A
    license
    A
    quality
    D
    maintenance
    An AI-powered security audit tool that analyzes codebases for vulnerabilities using real-time MITRE CWE data and npm audit. It enables users to perform comprehensive scans for authentication issues, exposed secrets, and dependency risks with structured remediation steps.
    2
    6 npm
    MIT

  • VibeCheck MCP Server

    philiphess1
    A
    license
    A
    quality
    D
    maintenance
    An AI-powered security audit tool that analyzes codebases for vulnerabilities using real-time data from MITRE CWE and npm audit. It enables deep analysis of authentication, API security, and dependencies to provide structured findings and remediation steps.
    2
    6 npm
    1
    MIT

Appeared in Searches