The most useful call is the one before installation: hand it a command, arguments and environment and get the same analysis without adding the server to anything. The findings are specific enough to act on — rule name, the tool and field it came from, the snippet, and a stated fix — which is what separates it from a scanner that only produces a score. Run the whole-config pass once on what you already have; the database and excessive-permission rules tend to surface tools you installed months ago and never reread.
A static security scanner for MCP setups. It reads the server definitions in your config — and their source where it can — and reports findings with a rule name, the exact location, the snippet that triggered it, an OWASP mapping and a fix.
- Prompt-injection checks over tool names, descriptions and parameter descriptions: instruction overrides, hidden system prompts, zero-width and invisible Unicode, role hijacking, credential-extraction instructions, jailbreak patterns and injected XML or HTML instruction tags
- Command-injection checks: a shell interpreter used as the server command, template literals in exec calls, subprocess with shell enabled, eval and new Function, child_process without execFile, and path traversal in server arguments
- Credential exposure: secrets hardcoded in a server's env block, and AWS, GitHub, npm, bearer and generic key patterns in source
- Auth-bypass patterns: commented-out authentication, TLS verification turned off, and always-false conditionals sitting in front of a security check
- Excessive permissions: shell, filesystem, database and network tools, tools with missing or permissive input schemas, and a high concentration of privileged tools in one server
- Database safety as its own category — a write tool with no read-only mode, exposed DROP, TRUNCATE or DELETE ALL, several write tools with no confirmation step anywhere, and a tool that accepts arbitrary SQL with no allowlist
- Findings filtered by minimum severity, and the source-file scan skippable when you want the config-only pass
- Your own configs discovered automatically in the standard locations for Claude Desktop and Cursor, scanned individually or all together in one report
- A single server definition — its command, arguments, environment and URL — scanned before it ever goes into a config
Nothing to authorize and no network calls: it runs as npx -y @piiiico/agent-audit --mcp and reads files on your machine. The auto-detection covers the standard config paths for Claude Desktop and Cursor; anything else is passed as an explicit path. The same package is a CLI with JSON output and severity thresholds, and a GitHub Action, so the same rules can run on every pull request — exit code 1 for high findings, 2 for critical. MIT.
One command — npm install -g @piiiico/agent-audit