Audit MCP Server

Every MCP server wired into your editor is a process that can read your files, reach the network, or run shell commands on your behalf - frequently launched from a remote npx/uvx package that can change underneath you. mcp-audit reads the MCP configs already on your machine and tells you what each server can do, how risky it is, whether its tool descriptions hide adversarial instructions, and whether anything…

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-08-24 · ★ 4 · #50 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MIT · Python servers · how we verify → /methodology

01 · Install Audit

before you install - you'll need

The README does not document required environment variables for a basic install.

Claude Code

claude mcp add saagpatel-mcpaudit -- uvx mcp-audits

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "saagpatel-mcpaudit": {
      "command": "uvx",
      "args": [
        "mcp-audits"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

pypi package mcp-audits - check the name against the project README before installing (PyPI has no namespace ownership)

registry namespace io.github.saagpatel is GitHub-verified and matches the repo owner

03 · What Audit can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v2.7.0 · 2026-08-16

MCPAudit 2.7.0 · Published from exact merge commit bd4edeea316e0aa3a719ddd9a180677e94918c1d. · Highlights: · Added deterministic fixture-first MCP cache-contract, Tasks time-machine, result-parcel, session-resume…

v2.5.0 · 2026-07-20

MCPAudit 2.5.0 · Proof Before Action is now published as part of MCPAudit 2.5.0. · Release boundary: · v2.5.0 · Package/source commit: 681da6fb287f9baed99fada4ca1eb145994700db · Publish workflow commit…

v2.4.0 · 2026-07-03

Added · AuditReport.warnings - structured ScanWarning entries for every requested check that was skipped or degraded (missing/stale pin baseline, missing credential or dependency, ignored option). Previously these were…

04 · Who maintains Audit

mcp-audit is maintained by saagpatel. We track 6 MCP servers from saagpatel - 6 actively maintained, 4 combined GitHub stars, oldest repo from Mar 2026.

05 · Facts

repository: github.com/saagpatel/mcpaudit
category: security - ranked #50 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 10+ releases in the last 90 days (latest 2026-08-16)
registry: io.github.saagpatel/mcp-audit (active, first published 2026-06-28 · 3 versions)
packages: pypi:mcp-audits

06 · Audit FAQ

What is Audit?

Is Audit still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-24 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

How do I install Audit?

Run `uvx mcp-audits`. The README does not document required environment variables for a basic install. You can also paste the ready-made client config above.

Does Audit run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Audit

Alternatives to Audit

Maintained security servers if Audit isn't the fit.

Pairs well with

Servers that cover what Audit doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Code Sentinel · Sapiom MCP Server · SAS Viya · Clearfront

More Python MCP servers · Cognitive AI Memory · Your Memory · Chimera Forge · Saidsef MCP GitHub PR Issue Analyser · Undesirables MCP Server · see all