Correctover Audit MCP

io.github.DSHCorrectoverPublished by GitHub account DSHCorrectoverv1.0.0Updated Nov 14, 2026

Free MCP session-security audit: unauthenticated tool surface, unbound session IDs. Read-only.

The publisher's own server: audit.domains - Domain Valuation

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that audits another MCP endpoint for session-security weaknesses and returns a re-verifiable verdict.

What you can do
  • Audit an MCP endpoint for session-security issues using three read-only probes
  • Check whether an anonymous client is issued a session during initialize
  • Check whether tools/list can enumerate the full tool inventory without a handshake
  • Return a verdict class such as unauthenticated-surface, authenticated-ok or error-*
When to use it
Use it when you operate an MCP server and want a quick, read-only check of whether its tool surface is exposed to anonymous clients, or when you want a verdict you can reproduce yourself.
Requirements
Runs as a local stdio process, installed via npx from a GitHub package; Node.js and network access to the endpoint being audited are needed. No accounts, API keys or environment variables are declared.
Before you install
Only audit endpoints you own or are authorized to test. The verdict is evidence-grade with timestamps and a reproduction command, not a certification. The README points to a paid contact for deeper review with signed evidence dossiers.

Installation

In SourceWeft

  1. Open Correctover Audit MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

correctover-audit-mcp

Free self-service MCP session-security audit as an MCP server. Ask your agent to audit an MCP endpoint and get a re-verifiable verdict (e.g. unauthenticated-surface) from 3 read-only probes — no handshake forgery, no exploit payloads.

Part of the Session-as-Identity research line: DSHCorrectover/mcp-session-audit (protocol + CI action + evidence).

Install (one line)

bash
claude mcp add correctover-audit -- npx -y github:DSHCorrectover/correctover-audit-mcp

Then ask your agent: "audit https://your-server.example/mcp for session-security issues".

What it checks

probemeaning
initialize (anonymous)does the server issue a session at all?
tools/list (zero handshake)can an anonymous client enumerate the full tool inventory?

Verdict classes: unauthenticated-surface (exposed) / authenticated-ok / error-*.

Honest scope

  • Read-only probes only; audit endpoints you own or are authorized to test.
  • The verdict is evidence-grade (timestamps + reproduction command), not a certification.
  • Deeper fail-closed review with signed evidence dossiers: [email protected]

MIT © 2026 Guigui Wang (Correctover) — "We sell the verdict, and you can re-verify it yourself."

Source: README.md at commit bc8c1b5

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestNov 14, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Web Search & Scraping27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Finance2 toolsOct 24, 2026

Cian Endpoint Audit

Published by GitHub account cian-spider

A remote MCP server with one paid tool that audits a public URL's HTTP status, redirects, TLS, security headers and DNS records.

Streamable HTTPWeb executable
Web Search & Scraping1 toolNov 14, 2026

Feed Audit (Product Feed Hygiene)

Published by GitHub account theharrisontruong-web

Remote MCP server that scans a Google Shopping-style product feed (XML, CSV or JSON) and returns a hygiene score, grade and top gaps.

Streamable HTTPWeb executable
Data & Analytics2 toolsNov 13, 2026

A11y Audit (ADA Lawsuit-Risk Scan)

Published by GitHub account theharrisontruong-web

Remote MCP server that scans a website URL for WCAG/ADA accessibility failures and returns a lawsuit-risk score, grade and top gaps.

Streamable HTTPWeb executable
Web Search & Scraping2 toolsNov 13, 2026