Audit Gap Auditor

io.github.GuardBeePublished by GitHub account GuardBeev0.4.1Updated Nov 3, 2026

OWASP MCP08 audit/telemetry gaps: missing tool-call logs, raw args in logs, disabled audit

The publisher's own server: audit.domains - Domain Valuation

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Audits MCP server source code for OWASP MCP08:2025 audit and telemetry gaps, flagging missing tool-call logs, raw args in logs and disabled audit.

What you can do
  • Scan a source string, a single file or a whole directory of MCP server code for audit and telemetry gaps
  • Report findings such as tools registered without any audit trail, raw tool arguments or results written to logs, audit hard-disabled in code, silently swallowed tool errors, and audit entries without a session or request id
  • List every OWASP MCP08 check the auditor runs, with severity and meaning
  • Limit logging checks to files that look like MCP tool servers, so unrelated helpers are ignored
When to use it
Useful when you build or review MCP servers and want a quick static check that tool invocations leave a usable, non-leaky audit trail. It suits pre-release reviews or CI-style checks on a source tree rather than runtime monitoring.
Requirements
Runs as a local stdio process, typically launched with npx from the npm package, so Node.js and network access for the package download are needed. No accounts, API keys, environment variables or headers are declared. It reads source files on the local machine.
Before you install
Telemetry is off by default; setting GUARDBEE_TELEMETRY=1 sends server, tool, success, duration and short parameter values such as file paths to the vendor, with longer strings and fields like content, token or password replaced by a placeholder. Scans read local source files, which may contain secrets. Findings are static pattern matches, not proof of runtime behaviour.

Installation

In SourceWeft

  1. Open Audit Gap Auditor in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-audit-gap-auditor

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP server that audits MCP server source for OWASP MCP08:2025 — Lack of Audit and Telemetry.

security-proxy already writes a hash-chained audit log at the gateway. This package asks a different question: does the MCP server itself leave a usable, non-leaky trail when a tool runs?

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► audit-gap-auditor ──► MCP server source              │              ├─ missing-telemetry  (tools registered, no audit/log/telemetry of invocations)              ├─ unsafe-logging     (raw tool args or results written to logs)              ├─ disabled-audit     (audit/telemetry hard-disabled in source)              └─ silent-failure     (tool errors swallowed with an empty catch)

What it flags

PatternSeverityOWASPMeaning
mcp_server_without_tool_audithighMCP08:2025McpServer / FastMCP registers tools but the file never mentions audit/telemetry
raw_tool_args_loggedcriticalMCP08:2025console/logger logs the full args/params/input object
raw_tool_result_loggedhighMCP08:2025Full result / toolResult logged
audit_disabled_in_codehighMCP08:2025audit: false, enableAudit: false, GUARDBEE_TELEMETRY=0, …
tool_error_swallowed_silentlymediumMCP08:2025Empty / return-only catch around a tool handler
audit_log_without_correlation_idmediumMCP08:2025audit.log({…}) with no sessionId / requestId / similar

Logging checks only run in files that look like MCP tool servers, so ordinary console.log(args) helpers elsewhere are ignored.

Quick start

json
{  "mcpServers": {    "guardbee-audit-gap-auditor": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-audit-gap-auditor"]    }  }}
bash
npx @guardbee/mcp-audit-gap-auditor scan ./src --fail-on=high --format=sarif > results.sarif

Tools

ToolPurpose
scan_textScan a source string
scan_fileScan one file
scan_directoryRecursive scan
list_patternsList MCP08 checks

guardbee.yml:

yaml
audit-gap-auditor:  fail-on: high  max-files: 5000  exclude:    - "fixtures/"

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/audit-gap-auditor/README.md at commit bc5997d

Tools

4

scan_text

Scan MCP server source for OWASP MCP08:2025 (Lack of Audit and Telemetry) gaps: tools registered with no audit trail, raw args/results logged, audit hard-disabled, silent catch blocks, audit events without a session/request id.

Parameterslabelcontentrequired

scan_file

Scan a single file for OWASP MCP08 audit/telemetry gaps

Parameterspathrequired

scan_directory

Recursively scan a directory of MCP server source for OWASP MCP08 audit/telemetry gaps

ParameterspathrequiredexcludeincludemaxFiles

list_patterns

List every OWASP MCP08 audit-gap check this auditor runs

Takes no parameters.

Version history

4
  1. v0.4.1LatestOct 30, 2026
  2. v0.3.2Oct 22, 2026
  3. v0.2.3Oct 13, 2026
  4. v0.2.2Oct 9, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Business & Commerce27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Developer Tools2 toolsOct 24, 2026

SEO Audit & Broken Link Checker

Published by GitHub account prometheus-maker

An Apify-hosted MCP server that audits a website's pages for SEO metadata and finds broken links and images, returning per-page scores.

Streamable HTTPWeb executableAuth
Data & AnalyticsCredential requiredNov 7, 2026

FinePrint AI Legal Risk & Contract Audit MCP Server

Published by GitHub account RitualDev-Lab

Local in-memory scanner that grades legal contracts, NDAs and leases for risk and drafts redline amendments for coding agents.

STDIODesktop only
AI & MLNot validated yetNov 7, 2026

Mcp Supply Audit

Published by GitHub account kimmawla

Audits MCP servers as supply-chain artifacts — registry entries, PyPI/npm packages, client configs and tool definitions — using read-only static checks.

STDIODesktop only
Developer ToolsNot validated · the package did not installNov 5, 2026