Automation Auditor MCP server

Automation Auditor MCP

One MCP server, several real automation export formats. Built and maintained by Ahmad Yar.

<!-- mcp-name: io.github.ahamdjin/automation-auditor-mcp -->

This is an early-stage implementation. See the PyPI package and MCP Registry entry for current publishing and version details. Host compatibility and real-client MCP behavior should be verified before production use. It performs read-only static checks on supplied text; it never reads your repo on its own, contacts automation accounts, runs JS, or connects to API endpoints.

Supported inputs and honest limitations

"Any automation platform" is not possible without an adapter for its native format. Unsupported platforms are reported as unsupported, rather than passing a meaningless check. You can add adapters to the registry in core.py and corresponding tests. Make, Zapier and Pipedream are not advertised as supported in v0.1.

Install

Install with Python 3.11+:

pip install automation-auditor-mcp

Configure a compatible MCP client:

{
  "mcpServers": {
    "automation-auditor": {
      "command": "uvx",
      "args": ["automation-auditor-mcp"]
    }
  }
}

uvx requires uv. Confirm the package's current published version on PyPI and test the configuration with your MCP host before production use.

For development from source:

python -m pip install -e . python -m unittest discover -s tests -v automation-audit examples/n8n-valid.json --platform n8n automation-auditor-mcp

The last command runs the MCP stdio server and waits for a connected client. Use a host or MCP Inspector to communicate with it; starting from an ordinary terminal should not print output.

MCP tool API

• auditworkflow(platform, source): Pass the full text contents of an export or Trigger.dev source file. platform is auto, n8n, dify, trigger, trigger.dev, or activepieces. Max 250,000 characters. The server does not** read files by path.
• auditopenapi(specjson): JSON OpenAPI document; uses the existing ahmad-yar-gpt-tools library.
• preflighturl(url): Pure URL screening; never performs DNS lookup or HTTP request. A permitted syntax becomes manualreview because real fetching requires request-time controls.
• listsupportedplatforms(): Exact supported formats and known limitations.

Findings include a stable rule ID, severity, location, brief message, recommendation and confidence. They intentionally do not echo node names, raw URLs, credentials or source snippets. A report of nofindingsdetected is not proof of safety.

Example: detect a broken n8n connection

Shortened. The full README is on GitHub.