Aggregate agency
unknownEach capability alone is unremarkable. All three reachable in one session is a complete data-theft path — the exposure exists only in combination, so reviewing servers individually cannot surface it.
Posture over time
continuous monitoringAdd a remote MCP server
HTTP endpoints only
Start a server in its own terminal, then paste its endpoint here. Only URLs
can be added at runtime: accepting a launch command over this API would let
anyone who can reach the dashboard execute local processes — the exact
weakness this tool reports as MCP-PROV-002. Local stdio servers
are configured by editing a config file, where filesystem permissions apply.
How do I start the demo servers?
Run each in a separate terminal from the repository root:
python3 demo_servers/01-clean-utility/server.py --http --port 9101 python3 demo_servers/02-corporate-kb/server.py --http --port 9102 python3 demo_servers/03-poisoned-helper/server.py --http --port 9103 python3 demo_servers/04-rugpull-vendor/server.py --http --port 9104 python3 demo_servers/05-broad-filesystem/server.py --http --port 9105 python3 demo_servers/06-cicd-integration/server.py --http --port 9106
Or print the list with uv run mcpaudit demo-servers.
Registered targets
Config files parsed
Local stdio servers come from these files. Edit them on disk to add or remove a server.
OAuth discovery
read-only
Most hosted MCP servers are OAuth-gated. A 401 is not a dead
end: it names a metadata document, which names the authorization server.
Walking that chain reveals the authorization posture — PKCE support,
scopes, and which origin can mint tokens — without authenticating.
This fetches published metadata only; no client is registered and no token
is requested.
Stored tokens
Tokens let live introspection enumerate a gated server's real tool surface,
which is what the six MCP-TOOL-* rules need. Stored
0600 and refreshed automatically. Values are never displayed
or returned by the API.
Interactive browser consent (PKCE)
The full authorization-code flow needs a browser redirect to a loopback listener, so it runs from the CLI rather than this page — the dashboard should not broker your consent to a third party:
uv run mcpaudit auth login <url> # registers a client, opens a browser uv run mcpaudit auth login <url> --client-id ID --client-secret SECRET # no browser (CI)
Tokens land in the same store this page reads, so they appear above on refresh.
Capability matrix
ranked by the server's own findings · click a row for detail| Server | Risk | Private data |
Untrusted input |
Outbound | Code exec |
Destruc- tive |
Tools | Basis | Auto-approve |
|---|---|---|---|---|---|---|---|---|---|
| Run a scan to populate. | |||||||||
Session counts findings that exist only because this server is loaded alongside others. Those are not defects in the server itself, so they do not raise its own risk rating.
Findings
Remediation plan
Ordered by severity, then by how cheaply the finding can be closed — so the first item is always the most serious thing that is also fastest to fix. Steps are generated from each finding's own evidence, so the same scan always yields the same plan.
Surface drift
noneTool surfaces that changed since the previous scan. A server can alter what it exposes without any local configuration change — detectable only by comparing against a stored snapshot, which is why a point-in-time scan cannot see it. SAF-T1201 MCP Rug Pull Attack.
SAF-MCP coverage
--Findings are mapped to SAF-MCP techniques (OpenSSF SIG-SAFE-MCP), a MITRE ATT&CK-aligned taxonomy of MCP attack techniques. Uncovered techniques are listed too: they generally need OAuth flow analysis or runtime telemetry that configuration and tool-surface inspection cannot provide.