mcp-audit-server

Thin MCP server and CLI proxy for AI agent and MCP security auditing. It connects to a private audit API to analyze MCP configurations, test prompt injection resistance, trace data flows, scan packages, and generate security policies.

This package is a thin proxy. All scan logic lives in a private backend operated by you or your provider.

Managed hosted flow:

• set AGENT_SECURITY_API_KEY

• the package will automatically target https://audit.leddconsulting.com

Self-hosted or private-network flow:

• set AGENT_SECURITY_BASE_URL to your HTTPS API origin

• or set AGENT_SECURITY_HOST and AGENT_SECURITY_PORT for a loopback/private deployment

Hosted backend access is not bundled with this package. If you want managed access or a licensed private deployment, contact Ledd Consulting.

Registry and Directories

• npm package: ledd-mcp-audit-server

• Official MCP Registry name: io.github.joepangallo/mcp-audit-server

• Downstream directories such as Glama and PulseMCP should ingest from the official MCP Registry, so you usually do not need separate manual submissions for each site.

• Glama authorship claim is optional. It only gives you ownership of the Glama page and access to manual sync and re-scan controls.

Related MCP server: aegis

Install

npm install ledd-mcp-audit-server

Install package: ledd-mcp-audit-server CLI command after install: mcp-audit-server

This is the public package that should be published to npm and listed in public MCP directories. The audit engine itself stays private.

The old package name mcp-server-agent-security is retired. See MIGRATION.md for upgrade steps and the deprecation plan.

Usage as MCP Server

Add to your MCP client configuration (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "mcp-audit-server": {
      "command": "npx",
      "args": ["-y", "ledd-mcp-audit-server", "--mcp"],
      "env": {
        "AGENT_SECURITY_API_KEY": "your-issued-api-key"
      }
    }
  }
}

For a self-hosted backend, add AGENT_SECURITY_BASE_URL to that same env block.

The server exposes 10 tools over stdio:

Usage as CLI

The CLI forwards commands to the private audit API.

# Hosted quick start
export AGENT_SECURITY_API_KEY=your-issued-api-key

# Audit an MCP configuration file
mcp-audit-server scan-config ./claude_desktop_config.json

# Probe a live MCP server (requires AGENT_SECURITY_ADMIN_MODE=1)
mcp-audit-server scan-server npx -y @modelcontextprotocol/server-filesystem /tmp

# Audit trust posture and policy drift for an agent/MCP deployment
mcp-audit-server scan-trust ./claude_desktop_config.json ./claimed-policy.json

# Scan an npm package for vulnerabilities
mcp-audit-server scan-package @modelcontextprotocol/server-shell

# Test a system prompt for injection vulnerabilities
mcp-audit-server scan-injection ./system-prompt.txt

# Trace data flows through an MCP config
mcp-audit-server scan-dataflow ./claude_desktop_config.json

# Auto-fix security issues in an MCP config
mcp-audit-server fix-config ./claude_desktop_config.json

# Harden a system prompt against injection
mcp-audit-server harden-prompt ./system-prompt.txt

# Generate a security policy from an MCP config
mcp-audit-server generate-policy ./claude_desktop_config.json

# Retrieve a previous audit report
mcp-audit-server report <audit-id>

# Output raw JSON instead of formatted tables
mcp-audit-server scan-config ./config.json --json

# Start in MCP stdio server mode
mcp-audit-server --mcp

For a self-hosted backend, also set AGENT_SECURITY_BASE_URL=https://your-audit-host.

Environment Variables

What It Detects

• Tool spoofing -- duplicate tool names, namespace collision (CWE-290)

• Rug pull -- unpinned packages, version drift (CWE-829)

• Prompt injection -- direct override, instruction hijacking, role-play escape, delimiter injection, encoding bypass, multilingual injection

• Privilege escalation -- overprivileged tools, shell execution without allowlists, unrestricted filesystem access

• Data exfiltration -- PII leakage through tool pipelines, outbound network paths

• Insecure transport -- missing TLS, plaintext credentials in config

• Missing auth -- unauthenticated MCP servers, missing API key requirements

• Shell injection -- arbitrary command execution via tool configurations

• Path traversal -- unrestricted filesystem scope in tool arguments

• SQL injection -- raw SQL patterns in tool definitions

• Rate limiting -- missing request throttling on exposed tools

• Package vulnerabilities -- known CVEs in npm MCP package dependencies

• Credential exposure -- inline secrets, missing rotation policies

• Agent trust drift -- claimed-safe policies that do not match configured tools, network posture, or observed action logs

• Weak provenance -- missing action/evidence capture for risky agent operations

Requirements

• Node.js >= 20

• Access to a private audit API. The managed hosted default is https://audit.leddconsulting.com when AGENT_SECURITY_API_KEY is set. Use AGENT_SECURITY_BASE_URL for other hosted HTTPS deployments, or AGENT_SECURITY_HOST and AGENT_SECURITY_PORT for local/private-network deployments.

Provenance

Versions 2.0.0 through 2.1.0 were published before the release workflow existed and do not carry provenance attestations. Version 3.0.1 and later are released through the provenance-enabled trusted-publishing workflow.

The release workflow in .github/workflows/publish.yml publishes v* tags with npm provenance (npm publish --provenance) via npm trusted publishing (OIDC — no long-lived token). Verify a release with npm audit signatures and the provenance badge on npmjs.com.

License

MIT

Built by Ledd Consulting