mcpaudit

Security scanner for MCP server Python code. Finds vulnerabilities before they reach production.

pip install mcp-vulnscan
mcp-vulnscan ./my-mcp-server

What it finds

Severity is high for confirmed MCP tool handlers (@mcp.tool), medium for unknown context.

Usage

# Scan a directory
mcp-vulnscan ./path/to/server

# Output as JSON for CI/CD
mcp-vulnscan ./path/to/server --format json

# Output as SARIF for GitHub Code Scanning
mcp-vulnscan ./path/to/server --format sarif --output-file results.sarif

# Only show high and critical findings
mcp-vulnscan ./path/to/server --min-severity high

# Run only specific rules
mcp-vulnscan ./path/to/server --rules shell_injection,path_traversal

# Exit code 0 even when findings exist (for reporting without blocking)
mcp-vulnscan ./path/to/server --no-exit-code

# Include test files (excluded by default)
mcp-vulnscan ./path/to/server --no-default-excludes

# Exclude generated code
mcp-vulnscan ./path/to/server --exclude '**/generated/**'

# Write output to a file
mcp-vulnscan ./path/to/server --format json --output-file findings.json

Baseline mode (CI onboarding)

Establish a baseline from an existing codebase so CI only fails on new findings:

# First run: saves current findings as baseline, exits 0
mcp-vulnscan ./src --baseline baseline.json

# Subsequent runs: only reports findings NOT in baseline
mcp-vulnscan ./src --baseline baseline.json

Commit baseline.json to your repo. From that point on, the scanner blocks only regressions.

Config file

Generate a project config:

mcp-vulnscan init

This creates .mcpaudit.toml in the current directory:

[mcpaudit]
min_severity = "low"
format = "text"
exclude = [
    "**/generated/**",
    "**/vendor/**",
]
rules = []   # empty = all rules

CLI flags always override the config file.

Suppressing findings

Add a comment to suppress a finding on a specific line:

result = eval(expr)           # mcpaudit: ignore
result = eval(expr)           # mcpaudit: ignore[CWE-95]
cursor.execute(query)         # mcpaudit: ignore[CWE-89]

CWE-specific suppression only silences that CWE on that line; other rules still apply.

GitHub Actions

Run tests in CI

- name: Run mcpaudit
  run: mcp-vulnscan ./src --format sarif --output-file mcpaudit.sarif --no-exit-code

- name: Upload to GitHub Code Scanning
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: mcpaudit.sarif

Block PRs on new findings

- name: mcpaudit (baseline diff)
  run: mcp-vulnscan ./src --baseline baseline.json

How it works

mcpaudit parses Python source with the ast module and traces data flow from MCP tool parameters to dangerous sinks. It classifies each function as:

• tool — decorated with @mcp.tool or @server.call_tool → findings reported as high
• unknown — no classifier signal → findings reported as medium
• safe — CLI code, @classmethod, utils directories, test functions → not flagged

Import aliases are tracked — import subprocess as sp; sp.run(cmd, shell=True) is detected. Session-based HTTP calls are tracked — requests.Session().get(url) is detected.

No external API calls. Runs fully offline.

License

MIT