claude-setup-audit-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@claude-setup-audit-mcpaudit this repo's Claude setup and tell me what to fix"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
claude-setup-audit-mcp
An MCP server that tells you why Claude Code keeps ignoring your instructions, then helps you fix it.
Three tools:
audit_claude_setup scores a repo's Claude Code setup from 0 to 100 and lists what to fix in order. It checks whether CLAUDE.md exists, whether it lists commands and do-not rules, whether it is short enough to be read, whether it leaks a credential, whether your subagents have proper frontmatter and restricted tools, whether you have skills, hooks, and an .mcp.json, and whether settings.local.json is git-ignored.
scaffold_agent writes a complete .claude/agents/<name>.md from a one-line job description, with frontmatter, a procedure, a report format, and do-not rules.
hook_recipes returns three settings.json hooks that work on Windows and macOS: a formatter after every edit, a guard that blocks destructive shell commands, and a bell when Claude stops and is waiting on you.
Install
Add to .mcp.json in your repo (or to Claude Code with claude mcp add):
{
"mcpServers": {
"claude-setup-audit": {
"command": "npx",
"args": ["-y", "claude-setup-audit-mcp"]
}
}
}On Windows, use "command": "cmd", "args": ["/c", "npx", "-y", "claude-setup-audit-mcp"].
Then in Claude Code: "audit this repo's Claude setup". It calls the tool and reads you the findings.
Related MCP server: memory-quality-mcp
Run from source
npm install
npm run build
npm run smoke # audits ../claude-code-starter-pack and checks all three toolsNo network calls, no telemetry. It reads files under the path you give it and nothing else.
What the score means
Under 40: Claude is working from nothing. Start with CLAUDE.md and the commands section. 40 to 70: the basics exist but nothing is enforced. Add hooks and restrict agent tools. Over 70: the setup is sound. The remaining gains come from agents written for your specific repeated jobs, which is what I do for teams. Details at github.com/shadrach16.
A ready-made starting point is the claude-code-starter-pack.
MIT licensed. Built by Tunde Oluwamo.
Available Tools
3 toolsaudit_claude_setupAudit a Claude Code setupA
Scores a repository's Claude Code setup (CLAUDE.md, .claude/agents, .claude/skills, hooks in settings.json, .mcp.json, .gitignore) from 0 to 100 and lists what to fix, in order. Pass the repo root path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to the repository root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses the main behavior (scoring and listing fixes), which implies a read-only analysis, but it does not explicitly state that no files are modified, nor does it describe any side effects or prerequisites (e.g., whether the path must exist or be a git repo). The core behavior is clear, but transparency is incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler. The first sentence front-loads the purpose, scope, and output; the second is a concise input instruction. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single required parameter and no output schema, the description covers the essential information: what the tool checks, what score range to expect, and that fixes come ordered. It could be more explicit about the exact return format or error behavior, but for this simplicity it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the path parameter is fully documented as 'Absolute or relative path to the repository root'. The description only repeats this instruction ('Pass the repo root path') without adding new meaning, so the schema already carries the semantic weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('scores'), the resource ('a repository's Claude Code setup'), and enumerates the specific components (CLAUDE.md, .claude/agents, .claude/skills, hooks in settings.json, .mcp.json, .gitignore). It also specifies the output (0-100 score and ordered fix list). This fully distinguishes it from siblings like scaffold_agent and hook_recipes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this when you want to audit a repository's Claude Code setup and get a prioritized list of fixes. It includes an explicit input instruction ('Pass the repo root path'). It does not explicitly state when not to use it, but the distinct purposes of sibling tools make selection straightforward.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hook_recipesHook recipesA
Returns three tested settings.json hook recipes (format after edit, block destructive commands, bell on stop) that work on Windows and macOS.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It clearly states that the tool returns recipes, not that it installs or modifies anything, and even adds 'tested' and 'work on Windows and macOS' context. This is transparent for a zero-parameter read-like tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the main action and resource, and compactly lists the three recipe types. Every word earns its place with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter tool with no output schema, the description is complete: it states the number of recipes, their purpose, and platform compatibility. An agent has enough information to invoke the tool correctly and understand what it will get back.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty and there are zero parameters, so there is nothing for the description to document. Baseline 4 applies; the description adds useful context about the returned content.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Returns') and a clear resource ('three tested settings.json hook recipes'), and names the exact recipes included. It does not explicitly contrast itself with siblings, but its resource and content are specific enough that an agent can tell it apart from audit_claude_setup and scaffold_agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: call this when settings.json hook recipes are needed. The description does not provide explicit when-to-use guidance, exclusions, or alternatives, though the sibling tools are distinct enough that confusion is unlikely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scaffold_agentScaffold a subagent fileA
Returns a complete .claude/agents/.md for a role, with frontmatter (name, description, tools), a procedure, a report format, and do-not rules. Save the returned text to .claude/agents/.md.
| Name | Required | Description | Default |
|---|---|---|---|
| job | Yes | One sentence: what this agent does, e.g. 'Reviews a diff for correctness bugs and reports file:line findings.' | |
| name | Yes | Agent name, e.g. reviewer or release-notes | |
| tools | No | Tool names to allow, e.g. ['Read','Grep','Glob']. Default is read-only. | |
| must_not | No | Rules the agent must never break | |
| read_first | No | Files the agent must read before working |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavior. It clearly discloses that the tool returns text rather than writing the file, instructs the caller to save the output to .claude/agents/<name>.md, and lists the generated file's components.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the action and output are front-loaded, and the save instruction is a clear follow-up. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five parameters all documented in the schema and no output schema, the description adequately explains the return value and next action. It could include more detail on defaults, but the combination of description and schema covers what an agent needs to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters and their meanings. The description does not add parameter-level detail but also does not need to; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (returns a complete .claude/agents/<name>.md for a role) and enumerates the output components (frontmatter, procedure, report format, do-not rules). This is clearly distinct from the sibling tools audit_claude_setup and hook_recipes, which target different concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the title and the description of the output: use this when you need to scaffold a subagent file. However, it does not explicitly state when to use this tool versus alternatives or provide exclusion conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
3 tool updates
v0.1.0- First observed
audit_claude_setup - First observed
hook_recipes - First observed
scaffold_agent
TDQS
Each tool has a clearly distinct purpose: one audits the setup, one scaffolds an agent file, and one returns hook recipes. There is no meaningful overlap or ambiguity between them.
All names use lowercase snake_case and two follow a verb_noun pattern (audit_claude_setup, scaffold_agent). hook_recipes is noun_noun, so the pattern is mostly consistent with a minor deviation.
Three tools is a well-scoped set for an audit-focused server. Each tool earns its place without redundancy or unnecessary surface area.
The audit tool covers the full setup surface, and there are helpers for agent files and hooks. However, other audited areas like CLAUDE.md, skills, .mcp.json, and .gitignore have no corresponding scaffold or recipe tool, leaving notable gaps for remediation.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Audit and repair any public GitHub repo. Free survey; paid source, unified diffs and a pull request.
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Lints + auto-fixes how AI coding agents discover any new product. 24 rules, 6 tools, score 0-100.
Deterministic AI code review, with an audit record. Governance inside the agent loop.
Related MCP Servers
- AlicenseAqualityFmaintenanceEnables scanning projects for leaked secrets and security issues directly from Claude Code, detecting secret categories, dangerous code patterns, and git hygiene issues.21MIT
- AlicenseNot gradedqualityDmaintenanceAudits your Claude Code memory store with 4-dimension quality scoring and actionable cleanup recommendations, including a visual dashboard.1MIT
- FlicenseNot gradedqualityDmaintenanceProvides code auditing tools including repository cloning, AST analysis, security scanning with Semgrep, and LLM-powered code explanations via the Model Context Protocol.-
- AlicenseNot gradedqualityAmaintenanceEnables scanning of code and URLs for security vulnerabilities (hardcoded secrets, missing headers, etc.) via Claude Code, integrating with the vibe-audit security scanner.13MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/shadrach16/claude-setup-audit-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server