Mcp Server Auditor

@guardbee/mcp-server-auditor

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans other MCP servers' tool definitions for insecure patterns.

While ai-code-scanner looks at general LLM/AI integration code, this package specifically looks at an MCP server itself: how privileged a tool defined via server.tool(...) is, how loose its parameters are, which dangerous sinks (shell/filesystem/HTTP/SQL) its handler passes tool input into directly. The MCP ecosystem is growing fast, but there's no common tool yet for auditing these servers' security.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► mcp-server-auditor ──► An MCP server's source code              │              ├─ Excessive agency    (execSync(input.command), a tool named "run_shell")              ├─ Unsafe input        (fetch(input.url) → SSRF, SQL string interpolation)              ├─ Loose schema        (a parameter typed z.any()/z.unknown())              ├─ Secrets exposure    (a hardcoded API key in a schema default, the entire process.env)              └─ Network exposure    (wildcard CORS)

Features

• 10 patterns, 5 categories — excessive-agency, unsafe-input, loose-schema, secrets-exposure, network-exposure
• Python and Go servers: tool input followed from the tool definition (FastMCP parameters, low-level arguments, go-sdk typed args, mcp-go request.RequireString(...)) through plain assignments into shell, file write/delete, HTTP and SQL calls
• Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
• SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
• Config file support via guardbee.yml
• A positive and a negative (false-positive) test for every pattern, with vulnerable and clean Python and Go fixtures

Quick Start

Claude Desktop / MCP Client

{  "mcpServers": {    "guardbee-mcp-server-auditor": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-server-auditor"]    }  }}

CLI (CI/CD)

npx @guardbee/mcp-server-auditor scan ./src --fail-on=high --format=sarif > results.sarif

MCP Tools

Detected Patterns

Python and Go

Python (.py) and Go (.go) files also get a tool-input flow check. The tool's input names come from its definition, are followed through plain assignments in the handler (command = f"du {directory}"), and a finding is reported when one reaches a sink call:

File findings are skipped when the handler checks the path against a base directory (is_relative_to, commonpath, .parents, filepath.IsLocal, filepath.Rel, strings.HasPrefix), and HTTP findings when it checks a host allowlist. Tools named run_shell, execute_sql etc. are reported for both languages. Rust, Java, Kotlin, C# and other languages get the language-neutral patterns only.

These are heuristic findings — a static text-pattern scan, not a full AST/type analysis. Designed for a low false-positive rate, but every finding should still be reviewed manually.

Configuration (guardbee.yml)

mcp-server-auditor:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  exclude:    - ".test.ts"    - "fixtures/"

Development

npm run buildnpm test

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.