What can you do with this server?

This server statically analyzes MCP server directories to audit their blast radius — what files, network, subprocesses, and environment variables they can access — and optionally enforces compliance against declared manifests. aos_compliance_validate — Scans a target MCP server directory and returns a pass/fail compliance report, including: * Dependency extraction (from requirements.txt, pyproject.toml, package.json) * Static Python AST analysis of file I/O, network calls, environment variable access, and subprocess usage * Divergence detection between declared manifest boundaries (permitted_output_paths / oracle_paths) and observed static behavior * Two gate modes: * advisory (default): Reports findings without blocking * blocking: Sets blocks_next_step=true on failure, enabling CI enforcement (exit 1 on divergence) * Optional tool_id label for identifying the scan in logs aos_compliance_self_test — A smoke/connectivity test to verify the MCP server wiring is functioning correctly. Additional support includes environment variables (AOS_VALIDATOR_TARGET_DIR, AOS_VALIDATOR_MCP_LOG, AOS_VALIDATOR_CALLER) and CLI tools: mcp-blast-radius (MCP stdio server) and mcp-blast-radius-gate (CI gate).

mcp-blast-radius

by aos-standard

Overview Schema Source Related Servers Score Discussions Admin

Python

Local

MCP Blast-Radius Auditor

AOS audited

See what any MCP server can actually touch — before you add it to your agent.

No manifest? You still get the full blast-radius report. Add a manifest to also catch divergences.

Also, if the server declares a manifest: Catch an MCP server that touches files it said it wouldn't — and block the merge in CI.

Statically extract what a third-party MCP server can reach (files, network, subprocess, env) via surface-level analysis. Compare against declared boundaries when a manifest is present.

Scan scope (default): production package only — excludes tests/, docs/, examples/, scripts/, benchmarks/, .github/, and test_*.py patterns; JSON output includes scan_scope and excluded_file_count. Pass --include-peripheral to scan the full repo.

Try it in 3 steps

① Scan your server in one command

pip install mcp-blast-radius==0.2.5
mcp-blast-radius-gate --gate-mode advisory --target-dir /path/to/your-mcp-server

Point --target-dir at your shipping package root (e.g. src/). Default scope excludes tests, docs, and scripts.

② Read the JSON

Field	What it means
`gate_pass`	Scan finished (`advisory` = report either way; `blocking` = exit 1 on divergences)
`blocking_reasons`	Lines starting with `DIVERGENCE:` = declared vs. observed mismatch (if you ship a manifest)
`blast_radius`	Static capability surface (network, subprocess, env, filesystem)
`confidence` labels	`declared` / `observed-static` / `cannot-determine` — static only, upper bounds

Undeclared capability is usually drift, not malice. Treat network/subprocess counts as upper bounds, not confirmed traffic.

③ Apply for an audit badge (optional, opt-in)

Ran a clean scan and want a signed README badge? Open a badge application — paste your command and JSON. Free, 90-day attestation, no phone-home. Criteria: BADGE_CRITERIA.md.

To verify any published attestation independently: pip install cryptography, then run packaging/scripts/verify_attestation.py (accepts local paths or HTTPS URLs). See BADGE_CRITERIA.md §Verify.

Related MCP server: cloud-pathfinder

Machine-readable metadata

Agent Card (capabilities, limitations, pricing): agent_card.json
Catalog entry (pricing, install, MCP endpoint): aos-standard/catalog
Spec: AOS-v0.1

Example walkthrough

git clone --depth 1 https://github.com/oraios/serena.git /tmp/serena
mcp-blast-radius-gate --gate-mode advisory --target-dir /tmp/serena

Inspect blast_radius and any DIVERGENCE: lines in blocking_reasons.

Report a scan question

Open a GitHub issue with your JSON output (structured template loads automatically).

30-second scan

pip install mcp-blast-radius
mcp-blast-radius-gate --gate-mode blocking --target-dir /path/to/mcp-server

pipx run mcp-blast-radius starts the MCP stdio server (for Claude Desktop / Cursor). For CLI scanning, use mcp-blast-radius-gate as above.

Red (blocking): divergence detected — code touches paths or capabilities not declared in manifest.
Green: no divergences (or no manifest — blast radius report only, advisory pass).

Install

python3 -m venv .venv
source .venv/bin/activate
pip install .

CLI entry

mcp-blast-radius          # MCP stdio server
mcp-blast-radius-gate     # CI gate (default blocking, exit 1 on fail)

CI blocking gate

mcp-blast-radius-gate --gate-mode blocking --target-dir .
# no divergences → exit 0 / divergences or declaration violations → exit 1

MCP tools

aos_compliance_validate — scan one MCP server directory (target_dir required; tool_id optional label)
aos_compliance_self_test — wiring smoke test

Default gate_mode=advisory. Use gate_mode=blocking in CI to fail on divergences.

What is extracted

Layer	Scope	Confidence
Dependencies	`requirements.txt`, `pyproject.toml`, `package.json`	`declared`
Python AST	imports, file I/O, network, env, subprocess; MCP tool attribution	`observed-static` / `cannot-determine`
Divergence	manifest `permitted_output_paths` / `oracle_paths` vs observed access	blocking when mismatch

Limitations: Static analysis only. Dynamic imports, getattr/eval, obfuscation, and native extensions may hide capabilities. We do not claim complete coverage — every finding includes a confidence label.

Environment

Variable	Purpose
`AOS_VALIDATOR_TARGET_DIR`	Default scan root when `target_dir` is omitted
`AOS_VALIDATOR_MCP_LOG`	JSONL path for local tool call log (never sent externally)
`AOS_VALIDATOR_CALLER`	Caller label (`ci`, `smoke_self_call`, etc.)

Example

aos_compliance_validate target_dir=/path/to/my-mcp-server gate_mode=blocking

License

MIT

Available Tools

2 tools

aos_compliance_self_testC

Self-connectivity check for MCP wiring.

ParametersJSON Schema

Name	Required	Description	Default
`mock`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

C2.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description implies a read-only operation (self-check) but does not disclose behavioral traits beyond that. With no annotations, it should provide details on side effects, permissions, or error conditions. The description lacks such transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (one sentence) and front-loaded. However, it sacrifices necessary detail for brevity, making it under-specified. It earns points for no fluff but loses for incomplete coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional boolean parameter, likely no side effects) and the presence of an output schema, the description still lacks essential context about what the self-test actually checks, what failure modes exist, and how the single parameter affects behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention the only parameter 'mock' or its meaning. Since schema description coverage is 0%, the description carries full responsibility but adds no value over the schema. This is a critical gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Self-connectivity check for MCP wiring' clearly states the tool's purpose (checking connectivity) and resource (MCP wiring). It is specific but could be improved by distinguishing from the sibling 'aos_compliance_validate'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The sibling tool exists but the description does not mention when to choose one over the other. Additionally, there is no context on prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aos_compliance_validateA

Validate one agent directory and return pass/fail with blocking_reasons.

gate_mode=advisory (default): returns pass/fail info, does NOT block next steps. gate_mode=blocking: pass=false sets blocks_next_step=true for CI enforcement.

ParametersJSON Schema

Name	Required	Default
`tool_id`	No
`target_dir`	No
`gate_mode`	No	advisory
`mock`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must cover behavioral traits. It discloses that advisory mode does not block while blocking mode does, and returns pass/fail with blocking_reasons. Missing details on authorization needs, side effects (likely read-only), or rate limits, but adequate for basic understanding.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each serving a purpose: first states overall function, second and third detail gate modes. No fluff, front-loaded with key info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core validation behavior and gate modes. An output schema exists, so return values are covered. However, with 4 parameters and 0% schema coverage, missing parameter explanations make the description incomplete. Additional details on target_dir and tool_id would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description should explain parameters. It only describes gate_mode; it does not explain tool_id, target_dir, or mock. This leaves significant ambiguity for the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'validate', the resource 'one agent directory', and the output 'pass/fail with blocking_reasons'. It distinguishes from sibling tool 'aos_compliance_self_test' which tests the compliance system itself, not a directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains both gate modes: advisory (default) returns info without blocking, and blocking sets blocks_next_step=true for CI enforcement. However, it does not explicitly guide when to use this tool versus the sibling self_test.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

2 tool updatesv0.1.0Jun 21, 2026
- First observedaos_compliance_self_test
- First observedaos_compliance_validate

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3.2/5.0

Scored 2026-06-21 23:20 across 2 tools

Disambiguation5/5

The two tools have clear distinct purposes: one checks connectivity (self-test) and the other validates agent directories. No overlap in functionality.

Naming Consistency5/5

Both tools use the consistent prefix 'aos_compliance_' followed by a verb in snake_case, creating a predictable naming pattern.

Tool Count3/5

With only 2 tools, the surface feels thin for a compliance validation server. However, it may be acceptable if the domain is narrow.

Completeness2/5

The server lacks common operations such as listing directories, retrieving past validations, or managing configurations, making it incomplete for typical compliance workflows.

Maintenance

ActivitySlowing

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

mcp-spec-compliance-mcp
io.github.CSOAI-ORG
MCP Spec Compliance MCP — audits any MCP server.json against the official Model Context Protocol
Testing & QA Tools Developer Tools
2
mcpcheck B
io.github.joeyough
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Penetration Testing Security
21
MANDATE Credential Broker B
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Security
111
cloud-pathfinder A
io.github.Baneado98
IaC attack-path auditor: finds internet-to-crown-jewel chains in Terraform/CFN/K8s.
Cloud Platforms Security Penetration Testing
2

Related MCP Servers

gke-cred-audit
Cloud Platforms Security
rrupesh
A
license
Not graded
quality
D
maintenance
Defensive credential-exposure auditor for GKE that inventories workload identity, service account tokens, and RBAC posture, exposing findings via an MCP server at /mcp.
Updated 4 months ago (2026-05-19 17:58 UTC)
Apache 2.0
cloud-pathfinder
Security Cloud Platforms Penetration Testing
Baneado98
A
license
A
quality
C
maintenance
MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.
Updated 3 months ago (2026-06-24 08:20 UTC)
2
MIT
mcp-heimdall
Penetration Testing Code Analysis
caglarbozkurt
A
license
Not graded
quality
A
maintenance
Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-server exfil chains no single server reveals. Zero-dependency local CLI, SARIF output, CI-gateable, no account.
Updated 2 months ago (2026-07-06 16:19 UTC)
65
MIT
dr-mcpofficial
Developer Tools Security
Inferensys
A
license
Not graded
quality
C
maintenance
Local-first MCP audit and cleanup tool that scans MCP configs to find stale servers, abandoned packages, duplicates, context-heavy tools, risky permissions, and major upgrades, generating reversible patch plans.
Updated 4 months ago (2026-05-20 08:51 UTC)
89
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/aos-standard/mcp-blast-radius'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

MCP Blast-Radius Auditor

Try it in 3 steps

Machine-readable metadata

Example walkthrough

Report a scan question

30-second scan

Install

CLI entry

CI blocking gate

MCP tools

What is extracted

Environment

Example

License

Available Tools

Output Schema

TDQS

Output Schema

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

gke-cred-audit

cloud-pathfinder

mcp-heimdall

dr-mcpofficial

Latest Blog Posts

MCP directory API