mcp-audit-tool

MIT static audit of MCP client configs — poisoning, rugs, secrets

AI Agents / Agents · OSS/MIT · 431

Reviewed 2026-10-04 · last push 2026-09-26 · repo checked 2026-10-19

What's Good

MIT (graygnatconsole/mcp-audit-tool). `pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git` then `mcp-audit scan` (auto-discovers client configs). 12 rules aimed at OWASP MCP Top 10-class issues; SARIF/JSON for CI; no LLM key required. Distinct from live MCP server probing — this is config static analysis. ★~79.

The Catch

Package: README PyPI badge may lag — install from the MIT git repo / pipx, not the unrelated PyPI name `mcpaudit` (different project). Vs mcp-scanner / hol-guard / skillspector: MCP Scanner audits MCP servers/tools; HOL Guard is runtime local allow/block; SkillSpector gates skills — mcp-audit-tool’s catch is client-config static audit. ★ still small; pin a commit; findings are leads, not proof.

Verdict

MIT MCP client-config auditor when you gate `.cursor/mcp.json` before connect — not Cisco MCP Scanner servers and not HOL Guard runtime policy.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/mcp-audit-tool.svg)](https://stackgems.com/gems/mcp-audit-tool)

HTML

<a href="https://stackgems.com/gems/mcp-audit-tool"><img src="https://stackgems.com/badge/mcp-audit-tool.svg" alt="mcp-audit-tool reviewed on Stack Gems" height="20"></a>

AI Agents →

Related