mcp-audit MCP server

mcp-audit

Wireshark + auditd, but for MCP.

mcp-audit sits transparently in front of any MCP server and records every tool call that passes through it — what was called, by whom, with which arguments, and what came back. One Go binary, no daemon, no Docker, no Kubernetes.

It answers the question every team adopting agents eventually has to answer: which tool did our agent call, when, and with what?

$ mcp-audit run -- npx -y @modelcontextprotocol/server-filesystem /tmp
mcp-audit dev | mode: stdio, wrapping "npx -y @modelcontextprotocol/server-filesystem /tmp"
mcp-audit config: built-in defaults (no config file found)
mcp-audit policy: shadow (recording only, nothing is blocked)
mcp-audit detectors: rug-pull, tool-poisoning
mcp-audit audit log: /home/you/.mcp-audit/logs/events.jsonl

That is the whole setup. No config file, nothing blocked, everything recorded.

Install

Download a binary for your platform from the latest release, or use npm:

npx mcp-audit-proxy run -- npx -y @modelcontextprotocol/server-filesystem /tmp

Build from source — Go 1.24 or newer, no other dependencies:

go build -o mcp-audit ./cmd/mcp-audit

Or install straight into your GOBIN:

go install github.com/firatmio/mcp-audit-proxy/cmd/mcp-audit@latest

Quick start

Local (stdio) MCP servers

Put mcp-audit run -- in front of the command you already run:

mcp-audit run -- npx -y @modelcontextprotocol/server-filesystem /tmp

Remote (Streamable HTTP) MCP servers

Point the proxy at the upstream server and your client at the proxy:

mcp-audit serve --target https://example.com/mcp --listen :9000

Authentication is not touched: Authorization headers, OAuth flows and Mcp-Session-Id all pass through exactly as they arrive.

Read the log

Every message is one JSON line:

$ tail -1 ~/.mcp-audit/logs/events.jsonl | jq
{
  "timestamp": "2026-08-12T13:05:08.466Z",
  "event_id": "236d1568-e1f0-4ab4-ba75-f10f74f7b2c9",
  "client_id": "",
  "server_name": "server-filesystem",
  "direction": "request",
  "method": "tools/call",
  "tool_name": "read_file",
  "arguments": { "path": "/etc/hosts" }
}

Some things you can do with it straight away:

# Which tools has this agent called, and how often?
jq -r 'select(.direction=="request" and .tool_name) | .tool_name' \
  ~/.mcp-audit/logs/events.jsonl | sort | uniq -c | sort -rn

# Show everything the policy engine flagged.
jq -c 'select(.policy_flags)' ~/.mcp-audit/logs/events.jsonl

# What arguments has a particular tool been called with?
jq -c 'select(.tool_name=="read_file") | {timestamp, arguments}' \
  ~/.mcp-audit/logs/events.jsonl

Connecting your MCP client

See examples/clients/ for drop-in config snippets for Claude Desktop, Cursor and Windsurf. The pattern is always the same: keep the command you had, and put mcp-audit run -- in front of it.

What it detects

Recording is the default. These checks run on top of it and, apart from RBAC, never block anything — they flag the event and print an alarm to stderr.

Tool poisoning

A poisoned MCP server hides instructions in a tool description. The user only sees a tool called echo; the model reads the rest. mcp-audit scans every advertised description and schema field for seven patterns:

Shortened. The full README is on GitHub.