LabscoMCP early access ↗
piiiicoMCP SERVER

Agent Prompt Injection Audit

Scans your MCP configuration for the things that turn an agent against you: prompt injection in tool descriptions, shell commands, hardcoded keys, and database tools that take raw SQL.

by piiiico ↗Agent Guardrails, Content Safety & AuditCommunity

LABSCO SUMMARY

Reads the server definitions you already trusted, and says which ones you should not have.

The most useful call is the one before installation: hand it a command, arguments and environment and get the same analysis without adding the server to anything. The findings are specific enough to act on — rule name, the tool and field it came from, the snippet, and a stated fix — which is what separates it from a scanner that only produces a score. Run the whole-config pass once on what you already have; the database and excessive-permission rules tend to surface tools you installed months ago and never reread.

What it is

A static security scanner for MCP setups. It reads the server definitions in your config — and their source where it can — and reports findings with a rule name, the exact location, the snippet that triggered it, an OWASP mapping and a fix.

What you get

  • Prompt-injection checks over tool names, descriptions and parameter descriptions: instruction overrides, hidden system prompts, zero-width and invisible Unicode, role hijacking, credential-extraction instructions, jailbreak patterns and injected XML or HTML instruction tags
  • Command-injection checks: a shell interpreter used as the server command, template literals in exec calls, subprocess with shell enabled, eval and new Function, child_process without execFile, and path traversal in server arguments
  • Credential exposure: secrets hardcoded in a server's env block, and AWS, GitHub, npm, bearer and generic key patterns in source
  • Auth-bypass patterns: commented-out authentication, TLS verification turned off, and always-false conditionals sitting in front of a security check
  • Excessive permissions: shell, filesystem, database and network tools, tools with missing or permissive input schemas, and a high concentration of privileged tools in one server
  • Database safety as its own category — a write tool with no read-only mode, exposed DROP, TRUNCATE or DELETE ALL, several write tools with no confirmation step anywhere, and a tool that accepts arbitrary SQL with no allowlist
  • Findings filtered by minimum severity, and the source-file scan skippable when you want the config-only pass
  • Your own configs discovered automatically in the standard locations for Claude Desktop and Cursor, scanned individually or all together in one report
  • A single server definition — its command, arguments, environment and URL — scanned before it ever goes into a config

Requirements

Nothing to authorize and no network calls: it runs as npx -y @piiiico/agent-audit --mcp and reads files on your machine. The auto-detection covers the standard config paths for Claude Desktop and Cursor; anything else is passed as an explicit path. The same package is a CLI with JSON output and severity thresholds, and a GitHub Action, so the same rules can run on every pull request — exit code 1 for high findings, 2 for critical. MIT.

Setup effort

One command — npm install -g @piiiico/agent-audit

See installation options