MCP Blast-Radius Auditor

io.github.aos-standardPublished by GitHub account aos-standardv0.2.8Updated Oct 24, 2026

Static blast-radius audit for MCP servers before agent install. Manifest optional.

The publisher's own server: Blast Radius

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Statically audits an MCP server's source to show what it can reach — files, network, subprocess, env — and flags divergences from its declared manifest.

What you can do
  • Scan one MCP server directory and return a blast-radius report of filesystem, network, subprocess and environment access
  • Compare observed access against a declared manifest and list divergences in blocking reasons
  • Run a wiring smoke test of the auditor itself
  • Report dependency declarations from requirements, pyproject and package.json files
  • Label each finding as declared, observed-static or cannot-determine
When to use it
Use it before adding a third-party MCP server to an agent, or in CI to block merges when a server touches paths or capabilities it did not declare. Useful when you want a static, upper-bound view of a package's reach without running it.
Requirements
Runs as a local Python package (installable with pip or uvx) over stdio, for desktop clients. You supply the target directory to scan, either as the target_dir argument or via the AOS_VALIDATOR_TARGET_DIR environment variable. Optional variables AOS_VALIDATOR_MCP_LOG and AOS_VALIDATOR_CALLER set a local call log path and caller label.
Before you install
Findings are static only and are upper bounds: dynamic imports, getattr/eval, obfuscation and native extensions can hide capabilities, so a clean scan is not proof of safety. Blocking mode exits non-zero on divergences and can fail CI. The optional badge application asks you to submit your command and JSON output, and the README points to a verification script that accepts remote URLs.

Installation

In SourceWeft

  1. Open MCP Blast-Radius Auditor in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

MCP Blast-Radius Auditor

[AOS audited]

See what any MCP server can actually touch — before you add it to your agent.

No manifest? You still get the full blast-radius report. Add a manifest to also catch divergences.

Also, if the server declares a manifest: Catch an MCP server that touches files it said it wouldn't — and block the merge in CI.

Statically extract what a third-party MCP server can reach (files, network, subprocess, env) via surface-level analysis. Compare against declared boundaries when a manifest is present.

Scan scope (default): production package only — excludes tests/, docs/, examples/, scripts/, benchmarks/, .github/, and test_*.py patterns; JSON output includes scan_scope and excluded_file_count. Pass --include-peripheral to scan the full repo.

Try it in 3 steps

① Scan your server in one command

bash
pip install mcp-blast-radius==0.2.5mcp-blast-radius-gate --gate-mode advisory --target-dir /path/to/your-mcp-server

Point --target-dir at your shipping package root (e.g. src/). Default scope excludes tests, docs, and scripts.

② Read the JSON

FieldWhat it means
gate_passScan finished (advisory = report either way; blocking = exit 1 on divergences)
blocking_reasonsLines starting with DIVERGENCE: = declared vs. observed mismatch (if you ship a manifest)
blast_radiusStatic capability surface (network, subprocess, env, filesystem)
confidence labelsdeclared / observed-static / cannot-determine — static only, upper bounds

Undeclared capability is usually drift, not malice. Treat network/subprocess counts as upper bounds, not confirmed traffic.

③ Apply for an audit badge (optional, opt-in)

Ran a clean scan and want a signed README badge? Open a badge application — paste your command and JSON. Free, 90-day attestation, no phone-home. Criteria: BADGE_CRITERIA.md.

To verify any published attestation independently: pip install cryptography, then run packaging/scripts/verify_attestation.py (accepts local paths or HTTPS URLs). See BADGE_CRITERIA.md §Verify.

Machine-readable metadata

Example walkthrough

bash
git clone --depth 1 https://github.com/oraios/serena.git /tmp/serenamcp-blast-radius-gate --gate-mode advisory --target-dir /tmp/serena

Inspect blast_radius and any DIVERGENCE: lines in blocking_reasons.

Report a scan question

Open a GitHub issue with your JSON output (structured template loads automatically).

30-second scan

bash
pip install mcp-blast-radiusmcp-blast-radius-gate --gate-mode blocking --target-dir /path/to/mcp-server

pipx run mcp-blast-radius starts the MCP stdio server (for Claude Desktop / Cursor). For CLI scanning, use mcp-blast-radius-gate as above.

  • Red (blocking): divergence detected — code touches paths or capabilities not declared in manifest.
  • Green: no divergences (or no manifest — blast radius report only, advisory pass).

Install

bash
python3 -m venv .venvsource .venv/bin/activatepip install .

CLI entry

bash
mcp-blast-radius          # MCP stdio servermcp-blast-radius-gate     # CI gate (default blocking, exit 1 on fail)

CI blocking gate

bash
mcp-blast-radius-gate --gate-mode blocking --target-dir .# no divergences → exit 0 / divergences or declaration violations → exit 1

MCP tools

  • aos_compliance_validate — scan one MCP server directory (target_dir required; tool_id optional label)
  • aos_compliance_self_test — wiring smoke test

Default gate_mode=advisory. Use gate_mode=blocking in CI to fail on divergences.

What is extracted

LayerScopeConfidence
Dependenciesrequirements.txt, pyproject.toml, package.jsondeclared
Python ASTimports, file I/O, network, env, subprocess; MCP tool attributionobserved-static / cannot-determine
Divergencemanifest permitted_output_paths / oracle_paths vs observed accessblocking when mismatch

Limitations: Static analysis only. Dynamic imports, getattr/eval, obfuscation, and native extensions may hide capabilities. We do not claim complete coverage — every finding includes a confidence label.

Environment

VariablePurpose
AOS_VALIDATOR_TARGET_DIRDefault scan root when target_dir is omitted
AOS_VALIDATOR_MCP_LOGJSONL path for local tool call log (never sent externally)
AOS_VALIDATOR_CALLERCaller label (ci, smoke_self_call, etc.)

Example

bash
aos_compliance_validate target_dir=/path/to/my-mcp-server gate_mode=blocking

License

MIT

Source: packaging/README.md at commit d75ea1c

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.8LatestSep 23, 2026
  2. v0.2.4Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Blast-Radius integrations

Blast Radius

ai.blast-radiusOfficial publisher

Lets an assistant read Blast Radius weekly AI market arguments, headlines, and an ETF quote, and assess companies with its framework.

Streamable HTTPWeb executable
Finance9 toolsOct 24, 2026

Agent Blast Radius

Published by GitHub account makash

Scan what an AI agent running as you can reach; optionally verify which keys are live (x402).

STDIODesktop only
Developer ToolsNot validated yetNov 3, 2026