MCP.Market

MCP Blast-Radius Auditor MCP server

by aos-standard·io.github.aos-standard/mcp-blast-radius·v0.2.8
No reviews yet

Static blast-radius audit for MCP servers before agent install. Manifest optional.

B72/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
New

0 stars28 downloads/wk

Reviews

Write one

Nobody has reviewed MCP Blast-Radius Auditor yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

MCP Blast-Radius Auditor tools (5)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • aos_compliance_self_test

    Self-connectivity check for MCP wiring.

  • aos_compliance_validate

    Validate one agent directory and return pass/fail with blocking_reasons.

  • get_precedent

    Return full English precedent sections from the bundled wheel (declared per-run).

  • list_precedents

    List bundled business-DNA precedents (metadata only, no charge in v0.1).

  • search_by_dna

    Filter precedents by DNA chain type (evidence, posting, approval, etc.).

Public scan report

scanner v0.1.10 · 2026-11-03 · same rubric, same numbers if you re-run it

1 medium
  • Code scan18 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 107 days ago8/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    mcp_blast_radius-0.2.8/precedents/PREC_DNA-0003.json: … pass_rate >= 75%) must precede dynamic eval (eval_pass_rate >= 80%).", "Close sta…
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How MCP Blast-Radius Auditor compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 40% of 4,460 AI and agents servers
Tools
5
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
28
more than 14% of 1,538 AI and agents servers with a package

What its tools let an agent do: 5 read

Release history: 2 versions in the registry since 2026-07-13, latest 2026-09-23, typically one every 71 days.

Install MCP Blast-Radius Auditor in Claude Code, Cursor or VS Code

claude mcp add mcp-blast-radius -- uvx mcp-blast-radius
Add to Cursor

What the publisher says

From the MCP Blast-Radius Auditor repository's README, as published. We do not edit it. Read it on GitHub

MCP Blast-Radius Auditor

<!-- mcp-name: io.github.aos-standard/mcp-blast-radius -->

See what any MCP server can actually touch — before you add it to your agent.

No manifest? You still get the full blast-radius report. Add a manifest to also catch divergences.

Also, if the server declares a manifest: Catch an MCP server that touches files it said it wouldn't — and block the merge in CI.

Statically extract what a third-party MCP server can reach (files, network, subprocess, env) via surface-level analysis. Compare against declared boundaries when a manifest is present.

Scan scope (default): production package only — excludes tests/, docs/, examples/, scripts/, benchmarks/, .github/, and test.py patterns; JSON output includes scanscope and excludedfilecount. Pass --include-peripheral to scan the full repo.

Try it in 3 steps

① Scan your server in one command

pip install mcp-blast-radius==0.2.5
mcp-blast-radius-gate --gate-mode advisory --target-dir /path/to/your-mcp-server

Point --target-dir at your shipping package root (e.g. src/). Default scope excludes tests, docs, and scripts.

② Read the JSON

Undeclared capability is usually drift, not malice. Treat network/subprocess counts as upper bounds, not confirmed traffic.

③ Apply for an audit badge (optional, opt-in)

Ran a clean scan and want a signed README badge? Open a badge application — paste your command and JSON. Free, 90-day attestation, no phone-home. Criteria: BADGE_CRITERIA.md.

To verify any published attestation independently: pip install cryptography, then run packaging/scripts/verifyattestation.py (accepts local paths or HTTPS URLs). See BADGECRITERIA.md §Verify.

Machine-readable metadata

  • Agent Card (capabilities, limitations, pricing): agent_card.json
  • Catalog entry (pricing, install, MCP endpoint): aos-standard/catalog
  • Spec: AOS-v0.1

Example walkthrough

git clone --depth 1 https://github.com/oraios/serena.git /tmp/serena
mcp-blast-radius-gate --gate-mode advisory --target-dir /tmp/serena

Inspect blastradius and any DIVERGENCE: lines in blockingreasons.

Report a scan question

Open a GitHub issue with your JSON output (structured template loads automatically).

30-second scan

pip install mcp-blast-radius
mcp-blast-radius-gate --gate-mode blocking --target-dir /path/to/mcp-server

pipx run mcp-blast-radius starts the MCP stdio server (for Claude Desktop / Cursor). For CLI scanning, use mcp-blast-radius-gate as above.

  • Red (blocking): divergence detected — code touches paths or capabilities not declared in manifest.
  • Green: no divergences (or no manifest — blast radius report only, advisory pass).

Install

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

MCP Blast-Radius Auditor: common questions

Is MCP Blast-Radius Auditor MCP server safe?
Mostly: it is graded B (72/100). Read the MCP Blast-Radius Auditor safety report
How do I install MCP Blast-Radius Auditor?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does MCP Blast-Radius Auditor need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is MCP Blast-Radius Auditor maintained?
The last commit was 108 days ago (2026-07-19). The latest release is v0.2.8.
What can I use instead of MCP Blast-Radius Auditor?
Servers from other publishers that do the same job: Decionis MCP server, Roast My Design System MCP server and Roast My Design System MCP server.
How does MCP Blast-Radius Auditor compare with other AI and agents MCP servers?
safety score 72/100 (higher than 40% of 4,460 AI and agents servers); tools 5 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to MCP Blast-Radius Auditor

Same job from other publishers: the closest match first, then the best rated.

  • Decionis
    Authorize consequential AI agent actions before execution
    A
  • Roast My Design System
    Audit your Design System and serve your Agent the rules that keep AI-written UI on-system.
    A
  • Roast My Design System
    Audit your Design System and serve your Agent the rules that keep AI-written UI on-system.
    A
  • three.ws Provenance
    Append-only, signed, on-chain-verifiable agent action log — record and audit what agents did.
    B