Code Audit MCP Server

An automated code audit tool based on Large Language Models (LLM) and the Model Context Protocol (MCP).

Features

• Code Semantic Parsing: AST parsing, type inference, taint marking

• Call Chain Tracing: Cross-file/cross-module data flow tracing

• Vulnerability Validation: Automatically generate PoCs and execute validation

• Multi-language Support: PHP, Python, Java, JavaScript/TypeScript

Related MCP server: deep-code-security

Quick Start

Requirements

• Node.js >= 18.0

• TypeScript >= 5.0

• Cursor / Windsurf (MCP-capable IDE)

Installation

git clone https://github.com/kkk1259/code-audit-mcp.git
cd code-audit-mcp
npm install
npm run build

Configuration

Configure the MCP Server in Cursor:

// .cursor/mcp.json
{
  "mcpServers": {
    "code-audit": {
      "command": "node",
      "args": ["./dist/server.js"],
      "env": {
        "PROJECT_ROOT": "/path/to/your/project"
      }
    }
  }
}

Usage Examples

SQL Injection Audit

用户: 请审计这个项目的SQL注入漏洞

AI: 我将使用MCP工具进行系统性审计。
    首先，识别所有用户输入源和SQL执行点...

Deserialization Vulnerability Discovery

用户: 检查是否存在反序列化漏洞

AI: 我将分析项目中的unserialize调用，并追踪POP链...

Tool List

Project Structure

code-audit-mcp/
├── src/
│   ├── server.ts          # MCP Server入口
│   ├── tools/
│   │   ├── parser.ts      # AST解析
│   │   ├── callgraph.ts   # 调用链追踪
│   │   ├── verifier.ts    # 漏洞验证
│   │   └── poc.ts         # PoC生成
│   ├── rules/
│   │   ├── php.json       # PHP安全规则
│   │   ├── python.json    # Python安全规则
│   │   └── java.json      # Java安全规则
│   └── utils/
│       ├── taint.ts       # 污点分析
│       └── sanitizer.ts   # 过滤函数识别
├── prompts/
│   ├── audit-system.md    # 系统Prompt
│   └── vuln-types/        # 各漏洞类型Prompt
├── tests/
├── package.json
└── README.md

Best Practices

✅ Do

• Audit by module; don't feed the entire project at once

• Run static tools first to get suspicious points, then use AI for in-depth analysis

• Prepare dedicated Prompts for each vulnerability type

• Let the AI understand the project structure (entry points, routes, database) before auditing

• Manually review AI reports, especially "high-risk" findings

• Save audit history for Prompt iteration and optimization

❌ Don't

• Don't blindly trust AI reports; false positives are inevitable

• Don't describe overly complex audit logic in Prompts

• Don't skip the vulnerability validation step

• Don't use cloud APIs for sensitive projects (use local models)

• Don't ignore business logic vulnerabilities (AI is weaker at these)

Expected Results

Overall efficiency: 3-5x improvement (including manual review time)

License

MIT License

Related Articles

• Automated Code Audit Workflow Based on LLM and MCP: From Source Code to Vulnerability PoC

Contributing

Issues and PRs are welcome!

Contact

• GitHub: kkk1259