# 🛡️ SecureAudit-MCP

**A Model Context Protocol (MCP) Server for C/C++ Static Code Auditing & Compiled PE/ELF Binary Security Parsing.**

*Equip your AI Coding Agents (Claude Code, Cursor, Cline) with safe, low-level binary analysis and secure static code scanning tools.*

***

## 🚀 Why SecureAudit-MCP?
AI Coding Assistants and Agentic loops are incredible at writing code, but they lack local system capabilities to check low-level binary compilation properties or perform deep static secure auditing.

**SecureAudit-MCP** solves this by standardizing tools under the **Model Context Protocol (MCP)**. By registering this server, your AI agent gains native, sandboxed commands to inspect C/C++ source code files for severe logic and library errors (like buffer overflows, format vulnerabilities, and command injections), parse local executables (Windows PE / Linux ELF) for binary hardening features (ASLR, DEP/NX, PIE), and extract printable ASCII strings securely.

***

## 🛠️ Features & Tools

### 1. `audit_source_code`
* **Purpose:** Performs lightweight static analysis scans on C/C++ source files.
* **Checks:**
  * Unsafe standard library functions (`strcpy`, `gets`, `sprintf`, `scanf`).
  * Heap overflow risks (like signed multiplications inside `malloc`).
  * Format string vulnerabilities (`printf(variable)` instead of `printf("%s", variable)`).
  * System-level command injection entry points (`system()`).
  * Basic memory leaks (unmatched `malloc` vs `free` statement loops).

### 2. `check_binary_protections`
* **Purpose:** Safely reads raw binary headers (first 1024 bytes) to check for defensive security compile flags.
* **Capabilities:**
  * Identifies formatting magic signatures (**PE** for Windows executables, **ELF** for Linux).
  * Evaluates architecture sizes (32-bit vs 64-bit).
  * In PE optional headers, parses `DllCharacteristics` to check for **ASLR (Dynamic Base)**, **DEP/NX (Data Execution Prevention)**, and **SafeSEH**.
  * In ELF headers, parses ELF type to identify **PIE (Position Independent Executable)** compiling.

### 3. `safe_extract_strings`
* **Purpose:** Securely parses ASCII string constants from compiled binaries (acting as a safe, local implementation of the standard Linux `strings` CLI utility) to identify indicator hashes, embedded secrets, or hardcoded URLs.

### 4. `remediate_vulnerability`
* **Purpose:** Supplies pre-compiled secure remediation blocks and structured replacement code templates for all identified vulnerabilities.

---

## 🎨 Architecture Flow
```
 ┌─────────────────┐             ┌─────────────────┐             ┌────────────────┐
 │  AI Agent Client│ ──────────> │ SecureAudit-MCP │ ──────────> │ Target Code /  │
 │  (Claude/Cline) │ <────────── │ (TypeScript SDK)│ <────────── │ Binary File    │
 └─────────────────┘  JSON-RPC   └─────────────────┘ File Read   └────────────────┘
```

---

## 🔌 Integration & Client Setup

Since this is a standard Model Context Protocol (MCP) server, it connects seamlessly with all major supporting IDEs and CLI agents.

### 1. Claude Desktop
Add this configuration snippet to your Claude Desktop configuration file (typically located at `%APPDATA%\Claude\claude_desktop_config.json` on Windows or `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):

```json
{
  "mcpServers": {
    "secureaudit-mcp": {
      "command": "node",
      "args": [
        "/path/to/secureaudit-mcp/build/index.js"
      ]
    }
  }
}
```

### 2. Cline (VS Code Extension)
In your Cline settings, select the **MCP Servers** panel:
* Click **Create/Add MCP Server**.
* Configure:
  * **Name:** `secureaudit-mcp`
  * **Command:** `node`
  * **Args:** `/path/to/secureaudit-mcp/build/index.js`

### 3. Cursor
In Cursor Settings -> **Beta Features** -> **MCP**:
* Click **+ Add New MCP Server**.
* Configure:
  * **Name:** `secureaudit-mcp`
  * **Type:** `stdio`
  * **Command:** `node /path/to/secureaudit-mcp/build/index.js`

---

## 💻 Local Quickstart & Development

### 1. Install & Build
Run the following commands inside the repository root to compile TypeScript files:
```bash
npm install
npm run build
```

### 2. Run Tools against the Demo Suite
This repository includes a pre-packaged vulnerable C file inside `/demo/vulnerable.c` containing various security vulnerabilities for testing purposes. 

Your MCP agent will be able to scan this file automatically. To inspect the tool definitions manually using the MCP developer command-line inspector (optional):
```bash
npx @modelcontextprotocol/inspector node build/index.js
```

---

## 📄 License
MIT License. Free to use and distribute under open-source terms.