Security Audit MCP Ver
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GITHUB_TOKEN | No | Optional GitHub fine-grained token with read-only repository Contents and Metadata permissions, used for higher API limits or private repositories. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| repository_inspectB | Read GitHub repository metadata. Read-only; no code is executed. |
| repository_treeC | List bounded repository paths from GitHub's Git tree API. |
| repository_read_fileB | Read one bounded text file from a GitHub repository. No code is executed. |
| cloudflare_reconnaissance_prepareB | Cloudflare Skill Phase 1 adapter: synthesize four caller-supplied read-only scout reports into run-metadata.json, architecture.md, and a canonical coverage-ledger.json validated by the upstream validator. Does not spawn agents or execute target code. |
| cloudflare_hunting_wave_prepareA | Cloudflare Skill Phase 2 parent-side planner: validate a canonical ledger, rank planned units deterministically, assign a bounded wave, and explicitly defer untouched units. Does not spawn hunters. |
| cloudflare_hunter_results_consolidateB | Cloudflare Skill Phase 2 parent-side consolidator: validate structured hunter unit results, ownership, source/local checks and parent-promoted artifact paths, then update only assigned ledger units. Does not execute targets or promote artifacts. |
| audit_reconnaissanceC | Phase 1: map repository metadata and paths, classify files, and create an initial not-yet-reviewed inventory. |
| source_security_reviewB | Phase 2/3: generate heuristic source-review candidates. Results are leads only and never confirmed automatically. |
| cloudflare_coverage_ledger_validateC | Validate a canonical coverage-ledger.json document with Cloudflare Security Audit Skill's upstream validator. |
| cloudflare_findings_validateC | Validate findings.json against Cloudflare Security Audit Skill's upstream report-schema.json and semantic checks. |
| audit_coverage_validateC | Phase 2: validate that every in-scope path has exactly one coverage-ledger entry. |
| audit_findings_validateB | Phase 4: validate finding structure, evidence fields and unique fingerprints. Needs-validation records cannot carry severity. |
| audit_independent_verifyB | Phase 5: compare findings against separately supplied reviewer checks. This tool does not spawn reviewers or claim independence by itself. |
| audit_report_generateC | Phase 6: validate coverage and separate reviewer checks, then generate target-neutral Markdown reports. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Several tools have overlapping or near-duplicate purposes: cloudflare_coverage_ledger_validate vs. audit_coverage_validate, and cloudflare_findings_validate vs. audit_findings_validate. An agent could easily pick the wrong validator or confuse the Cloudflare-specific adapter with the generic audit phase tool, even though descriptions provide some distinction.
Most names follow a verb_noun or resource_action pattern, but the set mixes four prefix families: cloudflare_, audit_, repository_, and a standalone source_security_review. The naming is readable but not predictable across the whole server.
Fourteen tools is reasonable for a multi-phase security audit workflow spanning reconnaissance, validation, review, verification, and reporting. The count is slightly inflated by parallel Cloudflare-specific and generic audit validators.
The surface covers the audit lifecycle from repository reconnaissance through findings validation, independent verification, and report generation. Minor gaps exist around remediation or code-diff inspection, but core workflows are covered.