mcp-audit-tool scans the Claude and Cursor config files on your machine for MCP servers that could hand a model your keys

Every MCP config a developer already runs is a live handoff to a model, and until now no lightweight tool read those files in bulk. The MIT-licensed mcp-audit-tool from graygnatconsole appeared on GitHub on 26 September 2026 and picked up 86 stars in a day. It is a pure-Python CLI that auto-discovers MCP server config files on the machine and grades each one against a fixed list of rules.

What it reads

The scanner walks the standard paths on macOS, Linux and Windows and picks up MCP entries from Claude Desktop, Cursor, Windsurf, Cline, Zed and VS Code Copilot without being told where to look. It parses the JSON, then runs each server through 12 detection rules that map to the OWASP MCP Top 10 categories.

What it flags

Six shapes of finding are documented in the README. Hardcoded API keys sitting in plaintext env blocks. Unpinned packages of the form npx -y some-mcp-server, which fetch the latest release at every launch and are the shape of the "rug pull" attack. Installer patterns that pipe curl into bash, or wrap a command in bash -c. Filesystem servers rooted at / or ~, which hand the model the whole disk. Tool descriptions carrying hidden instructions the model reads as prompts, called tool poisoning. Plaintext HTTP endpoints with no authentication, which any process on the network can invoke.

Each finding comes with a severity level and a specific remediation. The tool prints a score from 0 to 100 and a letter grade from A+ to F for the machine as a whole. It also emits JSON, and SARIF 2.1.0, which is the format GitHub Code Scanning reads: a build can fail on severity thresholds with --fail-on high.

How it runs

It is Python 3.9+ with three dependencies (typer, rich, pyyaml), and there is a pipx path and a plain pip path. There is no Node.js, no Docker and no LLM API key involved. It never asks the model anything. It is entirely a static analyzer over the JSON files the coding tools already have on disk.

An intentionally vulnerable example config ships with the repository, so you can run it and see the shape of the report without pointing the tool at your own machine first.

The reader who has been meaning to look

Anyone who has added a few MCP servers over the last few months, from a Reddit thread or a Twitter recommendation, is in the audience for this tool. MCP is now the standard way Claude, Cursor and the others reach outside their sandbox, and each new server is another vendor with a line in a JSON file most developers never open twice. A scanner that reads all of those in bulk and grades them before the next model call is a small thing to run, and 86 stars in a day says the audience knows it.

The trade is that this only sees what is written down. A server that opens a listening port on demand, or fetches its behaviour from a URL at run time, is not visible until it acts. But the six shapes the tool does catch cover most of the leaks that have been reported this year, and each one is a specific line in a specific file the reader can fix in minutes.

Source

Primary source: graygnatconsole/mcp-audit-tool on GitHub.