Magento Audit MCP server

mcp-magento-audit

<!-- mcp-name: io.github.michalper/mcp-magento-audit -->

An MCP server giving an AI agent tools to assess a Magento 2 / Adobe Commerce project along three axes: compatibility with a target PHP and Magento version, quality of custom modules, and dependency security.

It answers the question that never stops coming up in Magento agencies: "can we bump this client to a newer version, what's blocking it, and where do we start?"

Status: early stage. Built on evenings/weekends. All eight planned tools

(getprojectstatus, checkupdates, scanmodulerisk, auditsecurity, checkoutdatedpackages,

fetchreleasenotes, buildupgradeplan, buildfleetoverview) are working. See ROADMAP.md for

what's next.

How this differs from composer audit

composer audit and composer outdated are built into Composer and do their job well — auditsecurity and checkoutdated_packages actually shell out to them rather than reimplementing a CVE database or version comparison. This server targets what plain Composer doesn't give you:

zero coverage from vulnerability databases — and that's exactly the code agencies write. scanmodulerisk covers that side with phpcs/phpstan/rector instead.

1. It doesn't see app/code. Custom modules don't exist on Packagist, so they get

has an open CVE, is abandoned by its author, and has the worst complexity in the project — fix this one first. buildupgradeplan does, folding auditsecurity's advisories in alongside composer-constraint and code-quality blockers.

1. It doesn't combine axes. Nobody gets one answer: *this module blocks the upgrade,

today" requires stitching results together from many directories by hand. buildfleetoverview runs the composer-constraint check across every project path given to it in one call — a fast first pass, not a replacement for a full buildupgradeplan per project.

1. It doesn't aggregate across projects. "Which of our twenty stores can be upgraded

What this server doesn't pretend to be: there's no clean dataset of "module X works with Magento 2.4.8". Results are derived from declarations in composer.json, a code scan, and the vendor's own release notes — this is a decision-support tool, not an oracle. Upgrading a production store still requires testing, not just a report.

Install

git clone https://github.com/michalper/mcp-magento-audit.git
cd mcp-magento-audit
python3.12 -m venv .venv
.venv/bin/pip install -e ".[dev]"

Connecting to Claude Code

{
  "mcpServers": {
    "magento-audit": {
      "command": "/path/to/mcp-magento-audit/.venv/bin/mcp-magento-audit"
    }
  }
}

Projects that develop inside Docker/DDEV/Warden/Lando

Shortened. The full README is on GitHub.