Skip to main content
Glama
double527

audit-mcp-cli

by double527
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Local

audit-mcp-cli

npm version license audit-mcp-cli MCP server

English | 中文

A lightweight dependency vulnerability audit tool for Node.js projects. Supports CLI and MCP Server modes, covers npm and pnpm projects, and generates structured Markdown/HTML reports with full dependency chains.

Features

  • Full dependency chains — traces the complete path from your package.json to each vulnerable package

  • npm + pnpm support — auto-detects package manager by lockfile

  • Remote GitHub audit — audit any public or private repo without cloning

  • MCP Server — integrates with AI coding assistants (Claude, Cursor, etc.)

  • Markdown / HTML reports — clean, structured reports sorted by severity

  • CI gate — --fail-on exit code for CI/CD pipelines

  • Ignore mechanism — suppress accepted vulnerabilities with expiration dates

  • Severity filtering — show only vulnerabilities above a threshold

Related MCP server: mcp-web-audit

Install

# Run directly
npx audit-mcp-cli

# Or install globally
npm install -g audit-mcp-cli

Requires Node.js >= 18.

Usage

# Audit current directory
audit-mcp-cli

# Specific project path
audit-mcp-cli --path /path/to/project

# Remote GitHub repo (branch)
audit-mcp-cli --remote github:facebook/react --ref main

# Remote GitHub repo (tag)
audit-mcp-cli --remote github:facebook/react --ref v18.2.0

# Remote GitHub repo (commit SHA)
audit-mcp-cli --remote github:facebook/react --ref abc123def

# HTML report
audit-mcp-cli --format html --output report.html

# CI: fail if high+ severity vulnerabilities found
audit-mcp-cli --fail-on high

# Severity filtering (only show high and critical)
audit-mcp-cli --severity high

CLI Options

Option

Description

Default

--path <path>

Local project path

process.cwd()

--remote <repo>

Remote repo: github:owner/repo or https://github.com/owner/repo

—

--ref <ref>

Git ref (branch name / tag / commit SHA)

main

--token <token>

GitHub personal access token (for private repos)

GITHUB_TOKEN env

--format <fmt>

Report format: md or html

md

--output <path>

Output file path

audit-report.md or .html

--severity <level>

Minimum severity to display: low / moderate / high / critical

low

--fail-on <level>

CI fail threshold — exit 1 if vulnerabilities at this level or above exist

—

--mcp

Start as MCP Server

—

--lang <lang>

Language: en or zh-CN

Auto-detect from system

--fail-on exit codes

Value

Exits 1 when

critical

Any critical vulnerability found

high

Any high or critical found

moderate

Any moderate, high, or critical found

low

Any vulnerability found

(not set)

Always exits 0

MCP Server

Run as an MCP stdio server for AI assistants:

audit-mcp-cli --mcp

Claude Desktop

Basic (local projects & public repos):

{
  "mcpServers": {
    "audit-mcp-cli": {
      "command": "npx",
      "args": ["-y", "audit-mcp-cli", "--mcp"]
    }
  }
}

With GitHub token (private repos / avoid rate limits):

{
  "mcpServers": {
    "audit-mcp-cli": {
      "command": "npx",
      "args": ["-y", "audit-mcp-cli", "--mcp"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxxx"
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json:

Basic (local projects & public repos):

{
  "mcpServers": {
    "audit-mcp-cli": {
      "command": "npx",
      "args": ["-y", "audit-mcp-cli", "--mcp"]
    }
  }
}

With GitHub token (private repos / avoid rate limits):

{
  "mcpServers": {
    "audit-mcp-cli": {
      "command": "npx",
      "args": ["-y", "audit-mcp-cli", "--mcp"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxxx"
      }
    }
  }
}

Tool: audit_dependencies

The MCP server exposes one tool that supports both local and remote auditing:

Parameter

Description

projectPath

Local project path

remoteRepo

Remote repo: github:owner/repo

ref

Git ref (branch / tag / SHA)

token

GitHub token (for private repos, or use GITHUB_TOKEN env)

format

md or html

severity

Minimum severity filter

outputPath

Custom output file path

Returns: report file path + structured vulnerability details (CVSS, dependency chains, fix suggestions).

Token is optional. Local project auditing never requires a token. Remote public repos work without a token (60 requests/hour). Only private repos require a GitHub token.

Ignore Mechanism

Create .audit-mcp-cli-ignore.json in your project root to suppress accepted vulnerabilities:

{
  "ignore": [
    {
      "packageName": "minimist",
      "advisorySource": 1179,
      "reason": "Accepted risk, limited impact in our usage",
      "expiresAt": "2025-12-31T00:00:00Z"
    }
  ]
}

  • packageName — match all advisories for this package, or combine with advisorySource for exact match

  • expiresAt — optional, ignore auto-expires after this date

  • Ignored vulnerabilities are shown in a separate section of the report and excluded from --fail-on checks

CI Integration

# GitHub Actions example
- name: Security Audit
  run: npx audit-mcp-cli --fail-on high
# Generic CI
npx audit-mcp-cli --fail-on high && echo "pass" || echo "fail"

License

MIT

Available Tools

1 tool
audit_dependenciesA

Audit Node.js project dependencies for security vulnerabilities. Supports npm and pnpm projects, local or GitHub remote repos. Returns detailed vulnerability info (severity, CVSS score, dependency chains, fix suggestions) and generates Markdown/HTML report.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectPathNoLocal project path
remoteRepoNoRemote repo: github:owner/repo or https://github.com/owner/repo
refNoRemote ref (branch / tag / commit SHA), default: main
tokenNoGitHub token (for private repos), or use GITHUB_TOKEN env var
severityNoMinimum severity level, default: low
formatNoReport format, default: md
outputPathNoReport output file path

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions returns detailed vulnerability info and generates reports, but doesn't cover performance, network usage, or prerequisites (e.g., Node.js installation). Some behavioral aspects are omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences packed with essential information. No redundancy or fluff. Front-loaded with the primary purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 7 parameters, no output schema, and no annotations, the description covers the tool's purpose, supported scenarios, and output types. Some details like environment requirements are missing, but overall it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 7 parameters. The tool description adds context (supports npm/pnpm, returns report formats) but does not significantly enhance parameter understanding beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool audits Node.js project dependencies for security vulnerabilities, specifying supported package managers (npm, pnpm), project types (local or GitHub remote), and outputs (vulnerability info and reports). This is specific and action-oriented.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use: for security audits of Node.js dependencies, with guidance on local vs remote repos and supported formats. It lacks explicit when-not-to-use or alternatives, but given no siblings, it's clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 1 tool update
    • First observedaudit_dependencies
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.1/5.0
Disambiguation5/5

With only one tool, there is no possibility of confusion between tools. The tool's purpose is clearly defined.

Naming Consistency5/5

The single tool follows a clear verb_noun pattern (audit_dependencies), which is consistent and descriptive.

Tool Count4/5

The tool count matches the narrow scope of auditing Node.js dependencies. While a single tool may feel minimal, it fully covers the intended functionality.

Completeness3/5

The tool covers security auditing and report generation, which is the core purpose. However, it lacks support for other package managers (e.g., yarn) and additional lifecycle operations like fixing or updating dependencies.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • mcp-web-audit

    Shen-zhihao
    A
    license
    B
    quality
    D
    maintenance
    A Node.js-based frontend security audit tool that performs comprehensive dependency security audits for both local projects and remote repositories. Generates detailed Markdown reports with vulnerability detection, risk assessment, and fix recommendations.
    1
    17
    7
    ISC

  • mcp-audit

    daerda
    A
    license
    Not graded
    quality
    D
    maintenance
    A frontend security dependency auditing tool that identifies vulnerabilities in local and remote repositories using the Model Context Protocol. It provides detailed audit information like CVSS scores and dependency chains, generating standardized markdown reports.
    25
    MIT

  • locklens

    BARMPlus
    A
    license
    B
    quality
    D
    maintenance
    Audits package lockfiles for vulnerabilities, supporting npm, yarn, and pnpm. Runs via CLI or as an MCP server over stdio.
    1
    12
    83
    MIT

Appeared in Searches

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/double527/audit-mcp-cli'

If you have feedback or need assistance with the MCP directory API, please join our Discord server