Checkmcp

io.github.H129hjPublished by GitHub account H129hjv0.5.0Updated Oct 24, 2026

Audit any MCP server's security & quality — OWASP MCP Top 10 + explainable 0-100 MCP Score

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Audits any MCP server's security, tool design, schema quality and context cost, returning an explainable 0-100 MCP Score.

What you can do
CheckMCP is a vendor-neutral auditor for MCP servers. It exposes one tool, audit_mcp_server, so an agent can ask mid-conversation whether a given MCP server is safe. It scores seven pillars: security (OWASP MCP Top 10, tool poisoning, hardcoded secrets, command injection), tool design, schema and description completeness, context cost in tokens, protocol compliance, reliability and coverage of tools, resources and prompts. Every penalty is attributed as measure, mechanism, effect and score change, and hard floors cap the score when a secret appears in a schema or a handshake fails.
When to use it
Use it when you are evaluating an MCP server before adding it to an agent, or when you want a repeatable quality and security check in CI. It suits teams that need to compare servers, track score regressions, or answer whether a server is safe to connect.
Requirements
Runs locally as a stdio process, installed from PyPI as audit-mcp and started with uvx or pipx, so Python tooling is needed. No dependencies beyond the standard library; tiktoken is optional for exact token counts. Auditing an OAuth-protected server needs a bearer token passed on the command line. The --repo flag uses GitHub data, and --deep needs an external scanner such as mcp-scan or snyk.
Before you install
The --evals flag sends real traffic to the audited server, invoking read-only tools with canary inputs, so only run it against servers you are allowed to probe. The --token value is a credential passed on the command line. The optional gateway is run with GATEWAY_SECRET and GATEWAY_BACKEND_URL, and in active mode it blocks or strips traffic between agent and server. Hosted reports, badges and monitoring are offered at checkmcp.dev.

Installation

In SourceWeft

  1. Open Checkmcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

CheckMCP

[PyPI] [License: MIT] [GitHub Action] [Web audit]

Vendor-neutral quality / security / context-cost audit & score for any MCP server. One uvx/pipx command → an MCP Score /100 + causal opportunities (why the score), Lighthouse-style.

Installed from PyPI as audit-mcp (the name checkmcp was already taken); the command is audit-mcp. Brand, site and repo remain CheckMCP / checkmcp.dev.

bash
uvx audit-mcp https://mcp.deepwiki.com/mcp# orpipx run audit-mcp https://mcp.context7.com/mcp --jsonaudit-mcp https://my-mcp.example.com/mcp --token "$TOKEN"

Use it as an MCP server

audit-mcp mcp turns the auditor itself into an MCP server (stdio) exposing one tool, audit_mcp_server — so your agent can answer "is this MCP server safe?" mid-conversation.

bash
# Claude Codeclaude mcp add audit-mcp -- uvx audit-mcp mcp
json
// Cursor (.cursor/mcp.json) / Claude Desktop (claude_desktop_config.json){ "mcpServers": { "audit-mcp": { "command": "uvx", "args": ["audit-mcp", "mcp"] } } }

Registry name: io.github.H129hj/checkmcp

No dependencies (stdlib only). tiktoken optional for exact token counts.

What it measures (7 pillars)

  • Security — OWASP MCP Top 10 (tool poisoning, hardcoded secrets, command injection), lethal-trifecta.
  • Tool design — sprawl/consolidation (percentile-calibrated on real servers: median ~7 tools, p95 ~42).
  • Schemas / desc — descriptions + inputSchema/outputSchema completeness.
  • Context-cost — tokens spent on tools/list, paid on every request (the #1 pain of 2026).
  • Compliance — protocol-version gap, annotations, JSON-RPC error conformance, OAuth discovery.
  • Reliability — single-shot today (not credited; continuous T3 monitoring on checkmcp.dev).
  • Coverage — the 3 primitives (tools + resources + prompts).

Hard floors: secret-in-schema → cap D, failed handshake → cap F. Every penalty is attributed: measure → mechanism → effect → Δscore.

CLI flags

flagwhat
--jsonmachine-readable report
--badgeSVG badge + README embed snippets
--htmlstandalone SEO/GEO page (JSON-LD SoftwareApplication + FAQ)
--repo owner/nameadd maintenance/license/provenance signal from GitHub
--token <bearer>audit an OAuth-protected server
--min-score NCI: exit 1 if MCP Score < N
--baseline fileCI: pin tool definitions; fail on regression (rug-pull)
--gh-summaryCI: write a Markdown summary to $GITHUB_STEP_SUMMARY
--deepruntime depth via an external scanner (mcp-scan/snyk) if present
--evalsbehavioral sandbox: actually invokes read-only tools with canary inputs to catch tool-output prompt-injection, exfiltration vectors, secret/PII leakage and context bombs (sends real traffic; CI-fails on a malicious verdict)

GitHub Action

yaml
# .github/workflows/mcp-audit.ymlname: MCP auditon: [push, pull_request]jobs:  checkmcp:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: H129hj/checkmcp@v1        with:          url: https://my-mcp.example.com/mcp          min-score: "70"          baseline: .checkmcp-baseline.json   # commit it → fails on rug-pull

Behavioral evals (--evals)

Static analysis catches declared danger; --evals catches runtime danger by actually invoking read-only tools with canary inputs and inspecting the responses for tool-output prompt-injection, exfiltration vectors and secret/PII leakage (multilingual; optional callback-canary confirms exfil). CI-fails on a malicious verdict.

Self-hosted security gateway

Beyond auditing, CheckMCP ships an in-band MCP gateway — a proxy you put between your agent and an MCP server. It inspects every call, and in active mode blocks/strips tool-poisoning & exfiltration before they reach the agent. Run it in your own infra (tool traffic never leaves your network):

bash
docker pull ghcr.io/h129hj/checkmcp-gateway:latest   # or build from sourcedocker run -p 8080:8080 -e GATEWAY_BACKEND_URL=https://mcp.example.com/mcp \  -e GATEWAY_MODE=active -e GATEWAY_SECRET=$(openssl rand -hex 16) \  ghcr.io/h129hj/checkmcp-gateway:latest

See GATEWAY.md for config (passive/active, OAuth backends, policy, logs).

Hosted

Full reports, public directory, live badges, continuous drift monitoring, a governance policy API and a hosted gateway at checkmcp.dev.

Honest limitations

  • Percentile bands come from a growing corpus (one+ registries) — widening over time.
  • Exact tokens with pipx install "audit-mcp[exact-tokens]" (cl100k_base); otherwise chars/4 approximation.
  • Pillar weights are expert priors. python -m checkmcp.calibrate samples.json validates them against a labeled agent-success sample (per-pillar correlation + OLS-suggested weights + construct-validity R²) — supply real outcomes to close the loop.

MIT.

Source: README.md at commit 6d272b1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.5.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts