Auditor MCP server

by 4hmetuyar·io.github.4hmetuyar/mcp-server-auditor·v0.1.5·1 stars

Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets

B78/100grade B

What users say

No reviews yet

Safety scan

B78/100

Adoption

Growing

1 stars573 downloads/wk

Reviews

Nobody has reviewed Auditor yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

list_patterns
List all MCP server security patterns that the auditor can detect, grouped by category
scan_directory
Recursively scan an MCP server's codebase for insecure tool-definition patterns. Automatically skips node_modules, .git, dist, and binary files.
scan_file
Scan a single file for insecure MCP server/tool-definition patterns
scan_text
Scan a text string or code snippet for insecure MCP server/tool-definition patterns (excessive-agency tool names, shell/eval/SQL/SSRF sinks fed by raw tool input, overly permissive schemas, hardcoded secrets, wildcard CORS).

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

1 medium

Code scan15 source files scanned20/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identitynamespace and repository owner differ4/10

mediumeval / new Function usedexec.eval

dist/patterns.js: …o a remote code execution vector. Never eval() input; parse and validate it as data i…

Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y @guardbee/mcp-server-auditor on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-server-auditor -- npx -y @guardbee/mcp-server-auditor

From the Auditor repository's README, as published. We do not edit it. Read it on GitHub

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文

guardbee.ai — AI Security Copilot for websites.

GuardBee's family of MCP (Model Context Protocol) servers — a single monorepo, independent npm packages.

Nothing above is checked by us. What we check is on the safety report.

Is Auditor MCP server safe?: Mostly: it is graded B (78/100). Read the Auditor safety report
How do I install Auditor?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Auditor need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Auditor maintained?: The last commit was 12 days ago (2026-10-01). The latest release is v0.1.5.