Mcp Server Auditor

io.github.GuardBeePublished by GitHub account GuardBeev0.4.1Updated Nov 3, 2026

Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that scans other MCP servers' tool definitions and code for insecure patterns such as excessive agency, injection sinks and hardcoded secrets.

What you can do
  • Scan a text string or code snippet for insecure MCP tool-definition patterns
  • Scan a single file, or recursively scan a whole server codebase while skipping node_modules, .git, dist and binaries
  • Detect excessive agency, unsafe input (shell, eval, file write, SSRF, SQL), loose schemas, exposed secrets and wildcard CORS, including tool-input flow checks for Python and Go
  • List the supported patterns grouped by category
  • Report each finding with a risk explanation and a recommendation
When to use it
Useful when reviewing or hardening an MCP server you are building or adopting, and when you want a quick static security pass over tool definitions before exposing them to an assistant. Findings are heuristic, so it suits a first review rather than a replacement for manual audit.
Requirements
Runs as a local stdio process, typically launched with npx from the npm package @guardbee/mcp-server-auditor, so Node.js and network access for the package download are needed. No accounts, API keys or environment variables are declared.
Before you install
The scan reads source files from paths you point it at, so scope it to code you are allowed to inspect. Results are heuristic text-pattern matches, not full AST analysis, and should be reviewed manually. Telemetry is off by default; setting GUARDBEE_TELEMETRY=1 sends server, tool, success, duration and short parameter values such as file paths to a third party, with longer strings and fields like content, token or password replaced by a placeholder.

Installation

In SourceWeft

  1. Open Mcp Server Auditor in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-server-auditor

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans other MCP servers' tool definitions for insecure patterns.

While ai-code-scanner looks at general LLM/AI integration code, this package specifically looks at an MCP server itself: how privileged a tool defined via server.tool(...) is, how loose its parameters are, which dangerous sinks (shell/filesystem/HTTP/SQL) its handler passes tool input into directly. The MCP ecosystem is growing fast, but there's no common tool yet for auditing these servers' security.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► mcp-server-auditor ──► An MCP server's source code              │              ├─ Excessive agency    (execSync(input.command), a tool named "run_shell")              ├─ Unsafe input        (fetch(input.url) → SSRF, SQL string interpolation)              ├─ Loose schema        (a parameter typed z.any()/z.unknown())              ├─ Secrets exposure    (a hardcoded API key in a schema default, the entire process.env)              └─ Network exposure    (wildcard CORS)

Features

  • 10 patterns, 5 categories — excessive-agency, unsafe-input, loose-schema, secrets-exposure, network-exposure
  • Python and Go servers: tool input followed from the tool definition (FastMCP parameters, low-level arguments, go-sdk typed args, mcp-go request.RequireString(...)) through plain assignments into shell, file write/delete, HTTP and SQL calls
  • Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
  • SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
  • Config file support via guardbee.yml
  • A positive and a negative (false-positive) test for every pattern, with vulnerable and clean Python and Go fixtures

Quick Start

Claude Desktop / MCP Client

json
{  "mcpServers": {    "guardbee-mcp-server-auditor": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-server-auditor"]    }  }}

CLI (CI/CD)

bash
npx @guardbee/mcp-server-auditor scan ./src --fail-on=high --format=sarif > results.sarif

MCP Tools

ToolDescription
scan_textScans a given text/code snippet
scan_fileScans a single file
scan_directoryRecursively scans a directory (node_modules, .git, dist skipped automatically)
list_patternsLists all supported patterns by category

Detected Patterns

CategoryPatternSeverityOWASPWhat it means
excessive-agencyshell_exec_from_tool_inputcriticalMCP05:2025A tool handler passes tool input directly into a shell call like execSync/spawn
excessive-agencyeval_of_tool_inputcriticalMCP05:2025Tool input is executed as code via eval()/new Function()
excessive-agencyunrestricted_shell_tool_namehighMCP05:2025A tool name (run_shell, execute_sql, etc.) implies shell/SQL execution directly
unsafe-inputfs_write_from_raw_tool_inputhighA path from tool input flows into a file write/delete call with no validation (path traversal)
unsafe-inputssrf_fetch_from_tool_inputhighA URL from tool input flows directly into fetch/axios with no allowlist (SSRF)
unsafe-inputsql_injection_via_tool_inputcriticalMCP05:2025Tool input is interpolated into a SQL string via a template literal
loose-schemaoverly_permissive_tool_schemamediumA tool parameter is typed z.any()/z.unknown() — accepts anything
secrets-exposurehardcoded_secret_in_tool_schemacriticalA credential-shaped schema field's default value is a hardcoded literal
secrets-exposurefull_env_exposed_to_tool_callercriticalThe entire process.env is spread/stringified/returned (not one named variable)
network-exposurepermissive_cors_on_servermediumWildcard CORS (Access-Control-Allow-Origin: *) or cors() with no options

Python and Go

Python (.py) and Go (.go) files also get a tool-input flow check. The tool's input names come from its definition, are followed through plain assignments in the handler (command = f"du {directory}"), and a finding is reported when one reaches a sink call:

PatternSeveritySinks
python_shell_from_tool_inputcriticalsubprocess.*, os.system, os.popen, asyncio.create_subprocess_*
python_eval_of_tool_inputcriticaleval, exec
python_fs_write_from_tool_inputhighopen(..., "w"/"a"/"x"), os.remove/rename/…, shutil.rmtree/move, Path(...).write_text/unlink
python_ssrf_from_tool_inputhighrequests.*, httpx.*, client.get(...), urlopen (URL argument)
python_sql_injection_via_tool_inputcriticalcursor.execute(f"...{x}..."), % / .format / +
go_shell_from_tool_inputcritical (sh -c), high (argument list)exec.Command, exec.CommandContext
go_fs_write_from_tool_inputhighos.WriteFile, os.Remove, os.RemoveAll, os.Rename, os.Create, os.OpenFile for writing
go_ssrf_from_tool_inputhighhttp.Get/Post/NewRequest…, client.Get
go_sql_injection_via_tool_inputcriticaldb.Query…/Exec… with fmt.Sprintf or +

File findings are skipped when the handler checks the path against a base directory (is_relative_to, commonpath, .parents, filepath.IsLocal, filepath.Rel, strings.HasPrefix), and HTTP findings when it checks a host allowlist. Tools named run_shell, execute_sql etc. are reported for both languages. Rust, Java, Kotlin, C# and other languages get the language-neutral patterns only.

These are heuristic findings — a static text-pattern scan, not a full AST/type analysis. Designed for a low false-positive rate, but every finding should still be reviewed manually.

Configuration (guardbee.yml)

yaml
mcp-server-auditor:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  exclude:    - ".test.ts"    - "fixtures/"

Development

bash
npm run buildnpm test

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/mcp-server-auditor/README.md at commit 82be7b9

Tools

4

scan_text

Scan a text string or code snippet for insecure MCP server/tool-definition patterns (excessive-agency tool names, shell/eval/SQL/SSRF sinks fed by raw tool input, overly permissive schemas, hardcoded secrets, wildcard CORS).

Parameterslabelcontentrequired

scan_file

Scan a single file for insecure MCP server/tool-definition patterns

Parameterspathrequired

scan_directory

Recursively scan an MCP server's codebase for insecure tool-definition patterns. Automatically skips node_modules, .git, dist, and binary files.

ParameterspathrequiredexcludeincludemaxFiles

list_patterns

List all MCP server security patterns that the auditor can detect, grouped by category

Takes no parameters.

Version history

6
  1. v0.4.1LatestOct 30, 2026
  2. v0.3.0Oct 29, 2026
  3. v0.2.2Oct 22, 2026
  4. v0.2.1Oct 22, 2026
  5. v0.1.9Oct 13, 2026
  6. v0.1.8Oct 9, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts