MCP Security & Vulnerability Auditor

A zero-execution static AST security scanner and vulnerability auditor for Model Context Protocol (MCP) servers.

Detect critical remote code execution (RCE), arbitrary file access, leaked API keys, unauthenticated transports, and tool poisoning before connecting any untrusted MCP server to your AI agents, Claude Desktop, or Cursor environments.

🌟 Tools Exposed to AI Agents

This server exposes two specialized security tools to connected MCP clients:

1. audit_mcp_repository

   • Arguments:

     • repository_url (string, required): Public Git URL of the MCP repository to audit.

     • sub_directory (string, optional): Subdirectory path if auditing a specific tool inside a monorepo.

   • Action: Clones the repository shallowly without executing hooks, performs AST syntax analysis, and returns a Trust Score (0–100), letter grade (A+ to F), and formatted markdown report.

2. audit_local_directory

   • Arguments:

     • directory_path (string, required): Absolute path to a local directory containing MCP server code.

   • Action: Audits local source code without executing it.

Related MCP server: mcp-security-audit

🛡️ Vulnerability Rule Set

🚀 Quick Start & Installation

With Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "mcp-security-auditor": {
      "command": "python3",
      "args": ["/path/to/mcp-security-auditor/server.py"]
    }
  }
}

With Docker

docker build -t mcp-security-auditor .
docker run -i --rm mcp-security-auditor

📊 Empirical Benchmark (23 Public Servers)

We audited 23 prominent reference and community MCP servers:

📄 License

MIT License. Maintained by Neon Innovation Lab.