Audits MCP server configurations and packages for security risks such as typosquats, credential exposure, and malicious code, with zero dependencies and no execution.
A read-only MCP server that lets an agent audit its own environment by discovering local MCP configurations and skill folders on Windows, macOS, and Linux and running offline static checks for prompt injection, hidden instructions, hardcoded secrets, dangerous commands, unpinned packages, and excessive filesystem or transport permissions. It exposes tools to scan everything discovered, list configurations, vet a single skill, or analyze supplied text, returning text, JSON, SARIF, or HTML findings with CI-friendly severity levels.
Enables agents to inspect and diagnose their own MCP setup by exposing read-only tools that audit configured servers, report which coding agents have configs, surface misplaced or duplicated registrations, and list curated preset packs. It also powers CLI workflows for checking handshake, tool lint, and tool-surface quality scores of any stdio server.
Security for the MCP servers you use: detects tool poisoning, rug pulls, shadowing, secrets and supply-chain risk (OWASP MCP Top 10), with runtime guards and approved-server policy. Runs locally.
npm audit for MCP servers. Point it at an MCP server and get a security grade (A–F) covering missing auth, SSRF surface, high-privilege tools, prompt-injection-prone tool descriptions, and leaked secrets.
MCP server that watches upstream API providers for breaking changes, scans your codebase for impact, and drafts migration fixes locally, all offline-first with zero network.