Mcp Server Auditor

io.github.4hmetuyarPublished by GitHub account 4hmetuyarv0.1.5Updated Oct 24, 2026

Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Scans other MCP servers' source code and tool definitions for insecure patterns such as shell injection, SSRF, SQL injection and hardcoded secrets.

What you can do
  • Scan a code snippet, a single file or a whole directory for insecure MCP tool patterns
  • List the supported detection patterns grouped by category
  • Report findings with severity, OWASP mapping and a recommendation for each
  • Follow tool input through Python and Go handlers into shell, file, HTTP and SQL sinks
  • Produce SARIF output and fail thresholds for CI/CD use
When to use it
Useful when you are building or reviewing an MCP server and want a quick static check of how privileged its tools are, how loose their schemas are, and whether tool input reaches dangerous sinks. Also handy in CI to gate on high-severity findings.
Requirements
Runs locally over stdio, typically launched with npx from the npm package; Node.js is needed. No accounts, API keys or environment variables are declared. A guardbee.yml config file is optional.
Before you install
Findings are heuristic text-pattern matches, not full AST analysis, so each one should be reviewed manually. Telemetry is off by default; setting GUARDBEE_TELEMETRY=1 sends server, tool, success, duration and short parameter values such as file paths to a third party, with longer strings and fields like content, token or password replaced by a placeholder. Scanned code is read locally.

Installation

In SourceWeft

  1. Open Mcp Server Auditor in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-server-auditor

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans other MCP servers' tool definitions for insecure patterns.

While ai-code-scanner looks at general LLM/AI integration code, this package specifically looks at an MCP server itself: how privileged a tool defined via server.tool(...) is, how loose its parameters are, which dangerous sinks (shell/filesystem/HTTP/SQL) its handler passes tool input into directly. The MCP ecosystem is growing fast, but there's no common tool yet for auditing these servers' security.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► mcp-server-auditor ──► An MCP server's source code              │              ├─ Excessive agency    (execSync(input.command), a tool named "run_shell")              ├─ Unsafe input        (fetch(input.url) → SSRF, SQL string interpolation)              ├─ Loose schema        (a parameter typed z.any()/z.unknown())              ├─ Secrets exposure    (a hardcoded API key in a schema default, the entire process.env)              └─ Network exposure    (wildcard CORS)

Features

  • 10 patterns, 5 categories — excessive-agency, unsafe-input, loose-schema, secrets-exposure, network-exposure
  • Python and Go servers: tool input followed from the tool definition (FastMCP parameters, low-level arguments, go-sdk typed args, mcp-go request.RequireString(...)) through plain assignments into shell, file write/delete, HTTP and SQL calls
  • Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
  • SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
  • Config file support via guardbee.yml
  • A positive and a negative (false-positive) test for every pattern, with vulnerable and clean Python and Go fixtures

Quick Start

Claude Desktop / MCP Client

json
{  "mcpServers": {    "guardbee-mcp-server-auditor": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-server-auditor"]    }  }}

CLI (CI/CD)

bash
npx @guardbee/mcp-server-auditor scan ./src --fail-on=high --format=sarif > results.sarif

MCP Tools

ToolDescription
scan_textScans a given text/code snippet
scan_fileScans a single file
scan_directoryRecursively scans a directory (node_modules, .git, dist skipped automatically)
list_patternsLists all supported patterns by category

Detected Patterns

CategoryPatternSeverityOWASPWhat it means
excessive-agencyshell_exec_from_tool_inputcriticalMCP05:2025A tool handler passes tool input directly into a shell call like execSync/spawn
excessive-agencyeval_of_tool_inputcriticalMCP05:2025Tool input is executed as code via eval()/new Function()
excessive-agencyunrestricted_shell_tool_namehighMCP05:2025A tool name (run_shell, execute_sql, etc.) implies shell/SQL execution directly
unsafe-inputfs_write_from_raw_tool_inputhighA path from tool input flows into a file write/delete call with no validation (path traversal)
unsafe-inputssrf_fetch_from_tool_inputhighA URL from tool input flows directly into fetch/axios with no allowlist (SSRF)
unsafe-inputsql_injection_via_tool_inputcriticalMCP05:2025Tool input is interpolated into a SQL string via a template literal
loose-schemaoverly_permissive_tool_schemamediumA tool parameter is typed z.any()/z.unknown() — accepts anything
secrets-exposurehardcoded_secret_in_tool_schemacriticalA credential-shaped schema field's default value is a hardcoded literal
secrets-exposurefull_env_exposed_to_tool_callercriticalThe entire process.env is spread/stringified/returned (not one named variable)
network-exposurepermissive_cors_on_servermediumWildcard CORS (Access-Control-Allow-Origin: *) or cors() with no options

Python and Go

Python (.py) and Go (.go) files also get a tool-input flow check. The tool's input names come from its definition, are followed through plain assignments in the handler (command = f"du {directory}"), and a finding is reported when one reaches a sink call:

PatternSeveritySinks
python_shell_from_tool_inputcriticalsubprocess.*, os.system, os.popen, asyncio.create_subprocess_*
python_eval_of_tool_inputcriticaleval, exec
python_fs_write_from_tool_inputhighopen(..., "w"/"a"/"x"), os.remove/rename/…, shutil.rmtree/move, Path(...).write_text/unlink
python_ssrf_from_tool_inputhighrequests.*, httpx.*, client.get(...), urlopen (URL argument)
python_sql_injection_via_tool_inputcriticalcursor.execute(f"...{x}..."), % / .format / +
go_shell_from_tool_inputcritical (sh -c), high (argument list)exec.Command, exec.CommandContext
go_fs_write_from_tool_inputhighos.WriteFile, os.Remove, os.RemoveAll, os.Rename, os.Create, os.OpenFile for writing
go_ssrf_from_tool_inputhighhttp.Get/Post/NewRequest…, client.Get
go_sql_injection_via_tool_inputcriticaldb.Query…/Exec… with fmt.Sprintf or +

File findings are skipped when the handler checks the path against a base directory (is_relative_to, commonpath, .parents, filepath.IsLocal, filepath.Rel, strings.HasPrefix), and HTTP findings when it checks a host allowlist. Tools named run_shell, execute_sql etc. are reported for both languages. Rust, Java, Kotlin, C# and other languages get the language-neutral patterns only.

These are heuristic findings — a static text-pattern scan, not a full AST/type analysis. Designed for a low false-positive rate, but every finding should still be reviewed manually.

Configuration (guardbee.yml)

yaml
mcp-server-auditor:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  exclude:    - ".test.ts"    - "fixtures/"

Development

bash
npm run buildnpm test

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/mcp-server-auditor/README.md at commit fe7dc3a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.5LatestSep 29, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts