{"data":{"slug":"mcp-audit-tool","name":"mcp-audit-tool","tagline":"MIT static audit of MCP client configs — poisoning, rugs, secrets","category":"agents","categoryName":"AI Agents","url":"https://github.com/graygnatconsole/mcp-audit-tool","github":"https://github.com/graygnatconsole/mcp-audit-tool","pricing":"open-source","hook":"mcp-audit-tool is a MIT pure-Python CLI that statically audits Claude/Cursor/VS Code MCP client configs for tool poisoning, rug-pull installs, hardcoded secrets, and supply-chain smells — before the model runs them.","whatsGood":"MIT (graygnatconsole/mcp-audit-tool). `pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git` then `mcp-audit scan` (auto-discovers client configs). 12 rules aimed at OWASP MCP Top 10-class issues; SARIF/JSON for CI; no LLM key required. Distinct from live MCP server probing — this is config static analysis. ★~79.","theCatch":"Package: README PyPI badge may lag — install from the MIT git repo / pipx, not the unrelated PyPI name `mcpaudit` (different project). Vs mcp-scanner / hol-guard / skillspector: MCP Scanner audits MCP servers/tools; HOL Guard is runtime local allow/block; SkillSpector gates skills — mcp-audit-tool’s catch is client-config static audit. ★ still small; pin a commit; findings are leads, not proof.","verdict":"MIT MCP client-config auditor when you gate `.cursor/mcp.json` before connect — not Cisco MCP Scanner servers and not HOL Guard runtime policy.","addedAt":"2026-10-04","featured":false,"domain":"AI Agents","subSpecialty":"Agents","subcategory":"Security","tags":["mcp","cli","editor-plugin","self-host","permissive","security","active","young-repo"],"capabilities":["mcp","cli"],"surfaces":["MCP","CLI","Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"OSS/MIT","githubStars":431,"starsPerWeek":128,"access":"free","archived":false,"repo":{"createdAt":"2026-09-26","pushedAt":"2026-09-26","license":"MIT","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"claude-code","name":"Claude Code","tagline":"Terminal-first coding agent with deep repository context"},{"slug":"cursor","name":"Cursor","tagline":"The AI-first code editor that understands your codebase"},{"slug":"devin","name":"Devin","tagline":"Autonomous AI engineer for defined engineering tasks"},{"slug":"stagehand","name":"Stagehand","tagline":"AI-native browser automation that mixes code and natural language"},{"slug":"browser-use","name":"Browser Use","tagline":"Open-source framework for LLM-driven browser agents"}],"links":{"self":"/api/gems/mcp-audit-tool","html":"/gems/mcp-audit-tool","markdown":"/gems/mcp-audit-tool.md","category":"/api/gems?category=agents","categoryPage":"/stacks/agents"}}