Mmcp.market

Config Auditor MCP server

by 4hmetuyar·io.github.4hmetuyar/mcp-config-auditor·v0.3.1·1 stars
No reviews yet

Scans Cursor/Claude/Windsurf/VS Code MCP configs for unpinned versions, secrets, typosquats

A86/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A86/100

full report

Adoption
Growing

1 stars662 downloads/wk

Reviews

Write one

Nobody has reviewed Config Auditor yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Config Auditor tools (6)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • list_patterns

    List the MCP config, agent skill, and cross-server shadowing checks, with their OWASP MCP Top 10 tags.

  • scan_config_text

    Scan an MCP client config JSON string (Cursor mcp.json, Claude Desktop, Windsurf, or VS Code) for unpinned packages, secrets, wildcard auto-approve, unauthenticated remote endpoints, and typosquats.

  • scan_directory

    Find mcp.json, mcp_config.json, claude_desktop_config.json, and SKILL.md under a directory and audit each one. A directory scan also compares skill names. Does not start any MCP server.

  • scan_file

    Scan one MCP client config file, or a SKILL.md agent skill when the file has that name.

  • scan_inventory

    Detect cross-server tool shadowing from an inventory of tool catalogs. Pass the tool names and descriptions already collected from each installed server. This tool does not connect to those servers.

  • scan_skill_text

    Scan one agent SKILL.md (YAML frontmatter plus body) for unrestricted allowed-tools, instruction override, credential file reads, and literal secrets. Name collisions across skills require a directory scan.

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings
  • Code scan25 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identitynamespace and repository owner differ4/10
Overall 86/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Install Config Auditor in Claude Code, Cursor or VS Code

Runs npx -y @guardbee/mcp-config-auditor on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-config-auditor -- npx -y @guardbee/mcp-config-auditor
Add to Cursor

What the publisher says

From the Config Auditor repository's README, as published. We do not edit it. Read it on GitHub

guardbee-mcp

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文

guardbee.ai — AI Security Copilot for websites.

GuardBee's family of MCP (Model Context Protocol) servers — a single monorepo, independent npm packages.

Packages

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Config Auditor: common questions

Is Config Auditor MCP server safe?
Yes, by our scan: it is graded A (86/100). Read the Config Auditor safety report
How do I install Config Auditor?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Config Auditor need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Config Auditor maintained?
The last commit was 12 days ago (2026-10-01). The latest release is v0.3.1.

More from 4hmetuyar →