Skip to main content
Glama
Sign In
mcp-supply-audit

mcp-supply-audit

by kimmawla
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Related Servers

Alternatives to mcp-supply-audit

No user-submitted related servers found.

    Related Servers

    • mcpaudit

      AndrewXuTurtle
      A
      license
      Not graded
      quality
      C
      maintenance
      Audits MCP server configurations and packages for security risks such as typosquats, credential exposure, and malicious code, with zero dependencies and no execution.
      1
      MIT

    • mcp-guard

      actions-marketplace-validations
      A
      license
      Not graded
      quality
      B
      maintenance
      Lets an agent inspect and audit MCP servers before connecting to them, checking their exposed tools, prompts and resources for tool poisoning, shadowing, excessive permissions, leaked secrets and unsafe transports against 24 deterministic rules. Results are returned as findings with evidence, remediation and CWE/OWASP references, and can fail CI with SARIF, Markdown or standalone HTML reports.
      Apache 2.0

    • mcpscan

      fpavia111-creator
      A
      license
      Not graded
      quality
      B
      maintenance
      A read-only MCP server that lets an agent audit its own environment by discovering local MCP configurations and skill folders on Windows, macOS, and Linux and running offline static checks for prompt injection, hidden instructions, hardcoded secrets, dangerous commands, unpinned packages, and excessive filesystem or transport permissions. It exposes tools to scan everything discovered, list configurations, vet a single skill, or analyze supplied text, returning text, JSON, SARIF, or HTML findings with CI-friendly severity levels.
      14 npm
      MIT

    • toolfence

      dhb520cat
      A
      license
      A
      quality
      A
      maintenance
      Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.
      3
      MIT

    • ci-guard-mcp

      carelessdept
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables MCP clients to run deterministic, read-only local repository audits for risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration, returning structured findings without sending source code to a service.
      63 npm
      MIT

    • mcp-audit

      saagpatel
      A
      license
      Not graded
      quality
      A
      maintenance
      Audits MCP server configurations for security risks including capability inventory, SSRF, prompt injection, and drift detection. Works in read-only mode and can also be used as an MCP server to let AI agents audit their own attack surface.
      259 PyPI
      4
      MIT
    Deploy Server
    Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

    TDQS

    A4.5/5.0

    Scored across 6 tools

    Disambiguation5/5

    Each tool targets a distinct input artifact: a registry listing, a tools/list snapshot, a package name, a client config, a name for typosquat comparison, or the aggregate server audit. The descriptions explicitly state when to prefer another tool, and audit_server's overlap with the individual checks is disambiguated by its 'prefer another tool when the user wants only one specific check' guidance.

    Naming Consistency4/5

    All names are lowercase snake_case with a verb_noun shape, so the pattern is predictable. The mix of audit_ (composite analysis), scan_ (pattern detection over pasted text) and check_ (single yes/no question) is meaningful rather than arbitrary, though three different verbs is a minor deviation from a single consistent verb.

    Tool Count5/5

    Six tools map cleanly onto the five distinct supply-chain inputs plus one aggregate entry point, with no redundant members. Each tool earns its place and the count is well within a comfortable range.

    Completeness4/5

    The surface covers registry entries, package metadata, typosquatting, tool-definition poisoning, client configs, and an aggregator that composes them with documented limits and skipped-check reporting. Minor gaps exist around server runtime/behavioral auditing and bulk multi-server sweeps, but these are outside the stated static-audit scope and are workable around.

    Maintenance

    ActivityMaintained
    ResponsivenessSyncing

    Resources