What you can do with MCP Audit Tool

3 use cases

• Find leaked keys and risky MCP servers on your machine

  Scan every MCP config on a workstation and get a graded list of secrets and risky launch commands.

  • MCP Audit Tool
  • Security and science
  • Intermediate
  View prompt

  Use the GitHub repo graygnatconsole/mcp-audit-tool to run `mcp-audit scan <config-path>` on the MCP config at <config-path>. Return the score, grade, and a list of CRITICAL and HIGH findings with their rule IDs. Verify that the report lists each server name from the config file.

  Share Save

• Block risky MCP config changes in pull requests

  Run the audit in GitHub Actions, fail the build on high findings, and show results in Code Scanning.

  • MCP Audit Tool
  • Security and science
  • Intermediate
  View prompt

  Use the GitHub repo graygnatconsole/mcp-audit-tool to add a GitHub Actions workflow to <repo-path> that runs `mcp-audit scan` on the project MCP config files and writes SARIF output. Return the workflow file contents. Verify that the workflow has `security-events: write` permission and that the scan step includes `--format sarif`.

  Share Save

• Export a JSON audit report for team review

  Produce a machine-readable JSON file from one or more MCP configs for scripts or tickets.

  • MCP Audit Tool
  • Security and science
  • Intermediate
  View prompt

  Use the GitHub repo graygnatconsole/mcp-audit-tool to run `mcp-audit scan <config-path> --format json --output report.json` on <config-path>. Return a summary table of findings grouped by severity. Verify that report.json exists and parses as valid JSON before summarizing.

  Share Save

How to use MCP Audit Tool

1. Check you have what it needs: Python 3.9 or newer; pipx or pip available in the terminal; An MCP client config file (for example claude_desktop_config.json or .cursor/mcp.json), or access to the machine where those files live.
2. Open graygnatconsole/mcp-audit-tool on GitHub and read the README and license.
3. Install the tool with pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git.
4. Run mcp-audit scan to auto-discover and audit every MCP config on this machine.
5. Read the findings table and note every CRITICAL and HIGH row, starting with MAT-001 (hardcoded secrets) and MAT-004 (pipe-to-shell installers).
6. Move each exposed credential to a secrets manager and rotate it, then pin any unpinned npx, uvx, or pipx package to a known version.

These steps come from our top use case, Find leaked keys and risky MCP servers on your machine, which also has a copy-paste agent prompt.

MCP Audit Tool alternatives · Best AI repos for Security and science

About this repo

• Who it is forWritten for developers and security reviewers who run MCP servers in AI assistants like Claude Desktop or Cursor and want to check their configs before trusting them.
• Why it is hot
• LanguagePython
• Sourcegithub.com/graygnatconsole/mcp-audit-tool · Back to Hot repos

Requirements

• Python 3.9 or newer
• pipx or pip available in the terminal
• An MCP client config file (for example claude_desktop_config.json or .cursor/mcp.json), or access to the machine where those files live

Related repos

• Trended earlier Rea A plug-in that lets your AI agent take apart an app and explain how a feature works.
• Trended earlier Reverify Reverify is a Python toolkit and MCP server where deterministic tools verify every AI claim about a binary or code before it counts as fact.
• Trended earlier Ablation Ablation is a self-contained reverse engineering framework that, when used with Codex or Claude Code, works as an autonomous reverse engineering system.