This server statically analyzes MCP server directories to audit their blast radius — what files, network, subprocesses, and environment variables they can access — and optionally enforces compliance against declared manifests.
aos_compliance_validate — Scans a target MCP server directory and returns a pass/fail compliance report, including:
Dependency extraction (from requirements.txt, pyproject.toml, package.json)
Static Python AST analysis of file I/O, network calls, environment variable access, and subprocess usage
Divergence detection between declared manifest boundaries (permitted_output_paths / oracle_paths) and observed static behavior
Two gate modes:
advisory (default): Reports findings without blocking
blocking: Sets blocks_next_step=true on failure, enabling CI enforcement (exit 1 on divergence)
Optional tool_id label for identifying the scan in logs
aos_compliance_self_test — A smoke/connectivity test to verify the MCP server wiring is functioning correctly.
Additional support includes environment variables (AOS_VALIDATOR_TARGET_DIR, AOS_VALIDATOR_MCP_LOG, AOS_VALIDATOR_CALLER) and CLI tools: mcp-blast-radius (MCP stdio server) and mcp-blast-radius-gate (CI gate).
See what any MCP server can actually touch — before you add it to your agent.
No manifest? You still get the full blast-radius report. Add a manifest to also catch divergences.
Also, if the server declares a manifest: Catch an MCP server that touches files it said it wouldn't — and block the merge in CI.
Statically extract what a third-party MCP server can reach (files, network, subprocess, env) via surface-level analysis. Compare against declared boundaries when a manifest is present.
Scan scope (default): production package only — excludes tests/, docs/, examples/, scripts/, benchmarks/, .github/, and test_*.py patterns; JSON output includes scan_scope and excluded_file_count. Pass --include-peripheral to scan the full repo.
① Scan your server in one command
pip install mcp-blast-radius==0.2.5
mcp-blast-radius-gate --gate-mode advisory --target-dir /path/to/your-mcp-serverPoint --target-dir at your shipping package root (e.g. src/). Default scope excludes tests, docs, and scripts.
② Read the JSON
Field | What it means |
| Scan finished ( |
| Lines starting with |
| Static capability surface (network, subprocess, env, filesystem) |
|
|
Undeclared capability is usually drift, not malice. Treat network/subprocess counts as upper bounds, not confirmed traffic.
③ Apply for an audit badge (optional, opt-in)
Ran a clean scan and want a signed README badge? Open a badge application — paste your command and JSON. Free, 90-day attestation, no phone-home. Criteria: BADGE_CRITERIA.md.
To verify any published attestation independently: pip install cryptography, then run packaging/scripts/verify_attestation.py (accepts local paths or HTTPS URLs). See BADGE_CRITERIA.md §Verify.
Related MCP server: mcpaudit
Agent Card (capabilities, limitations, pricing): agent_card.json
Catalog entry (pricing, install, MCP endpoint): aos-standard/catalog
Spec: AOS-v0.1
git clone --depth 1 https://github.com/oraios/serena.git /tmp/serena
mcp-blast-radius-gate --gate-mode advisory --target-dir /tmp/serenaInspect blast_radius and any DIVERGENCE: lines in blocking_reasons.
Open a GitHub issue with your JSON output (structured template loads automatically).
pip install mcp-blast-radius
mcp-blast-radius-gate --gate-mode blocking --target-dir /path/to/mcp-serverpipx run mcp-blast-radius starts the MCP stdio server (for Claude Desktop / Cursor). For CLI scanning, use mcp-blast-radius-gate as above.
Red (blocking): divergence detected — code touches paths or capabilities not declared in manifest.
Green: no divergences (or no manifest — blast radius report only, advisory pass).
python3 -m venv .venv
source .venv/bin/activate
pip install .mcp-blast-radius # MCP stdio server
mcp-blast-radius-gate # CI gate (default blocking, exit 1 on fail)mcp-blast-radius-gate --gate-mode blocking --target-dir .
# no divergences → exit 0 / divergences or declaration violations → exit 1aos_compliance_validate — scan one MCP server directory (target_dir required; tool_id optional label)
aos_compliance_self_test — wiring smoke test
Default gate_mode=advisory. Use gate_mode=blocking in CI to fail on divergences.
Layer | Scope | Confidence |
Dependencies |
|
|
Python AST | imports, file I/O, network, env, subprocess; MCP tool attribution |
|
Divergence | manifest | blocking when mismatch |
Limitations: Static analysis only. Dynamic imports, getattr/eval, obfuscation, and native extensions may hide capabilities. We do not claim complete coverage — every finding includes a confidence label.
Variable | Purpose |
| Default scan root when |
| JSONL path for local tool call log (never sent externally) |
| Caller label ( |
aos_compliance_validate target_dir=/path/to/my-mcp-server gate_mode=blockingMIT
Self-connectivity check for MCP wiring.
Inputs: mock. Returns: object
Validate one agent directory and return pass/fail with blocking_reasons.
gate_mode=advisory (default): returns pass/fail info, does NOT block next steps. gate_mode=blocking: pass=false sets blocks_next_step=true for CI enforcement.
Inputs: tool_id, target_dir, gate_mode, mock. Returns: object
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 2 tools
The two tools have clear distinct purposes: one checks connectivity (self-test) and the other validates agent directories. No overlap in functionality.
Both tools use the consistent prefix 'aos_compliance_' followed by a verb in snake_case, creating a predictable naming pattern.
With only 2 tools, the surface feels thin for a compliance validation server. However, it may be acceptable if the domain is narrow.
The server lacks common operations such as listing directories, retrieving past validations, or managing configurations, making it incomplete for typical compliance workflows.
MCP Spec Compliance MCP — audits any MCP server.json against the official Model Context Protocol
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws.
