@miaggy/mcp-audit 0.3.0

Audits the MCP servers a machine is configured to run. This release makes the audit account for every server it discovers, assess PyPI (uvx/pipx) servers, and read more client config locations.

Requires @miaggy/core 0.3.0.

Breaking

• Drift baseline format is now version 2. Server identity changed from client:name to client:name:source, so two servers with the same name in different config locations no longer collapse into one entry. Version-1 baselines are rejected on read. To migrate, run mcp-audit snapshot again to regenerate mcp-audit-baseline.json.

New

• Coverage-skip findings: every discovered server that no rule assessed is named with the reason, and these now appear in the report, not only in --json. An empty findings list means the tool looked and found nothing, not that it skipped a server.
• PyPI servers: uvx/pipx servers are checked for pinning and maintenance. PyPI publishes no install-script or provenance data, so those are named as a residual.
• Project-scoped servers under projects.<path>.mcpServers in ~/.claude.json (Claude Code) are discovered.
• More clients: Goose (read without a YAML dependency), plus best-effort Windsurf, Cline, Continue, and Zed. VS Code settings are read from Code, Code - Insiders, and VSCodium.

Changed

• Container images are out of scope by design: docker/podman servers are discovered and named, but their images are not assessed. Use a container scanner such as Trivy or Grype for the image itself.
• The report footer shows the live version; the HTML report filename uses the local date.
• Finding IDs include the config source, so same-named servers in different locations no longer collide.

Full notes: packages/mcp-audit/CHANGELOG.md.

@miaggy/core 0.3.0

The shared audit engine used by the scanner packs.

• Report renderers now list NOT_APPLICABLE findings in a "Not assessed" section, so coverage and skip findings appear in the HTML and markdown report, not only in the JSON output. Reports without such findings render as before.
• Report contexts accept an optional metaLabels field, letting a pack relabel the account and region meta line (mcp-audit uses "Machine" and "Scope").
• The roleplay-jailbreak injection signature now matches the article "an" as well as "a", for example "pretend you are an uncensored model".

No breaking changes. Full notes: packages/core/CHANGELOG.md.

mcp-audit-v0.2.0

Waves 2 and 3: opt-in live manifest scan (handshake-only MCP client; tool-description injection signatures, cross-server tool shadowing, unannotated destructive tools, oversized descriptions) and drift baselines ('mcp-audit snapshot' + 'audit --baseline', documented format with hashed descriptions and names-only env). Also hardens Wave 1: untrusted config strings sanitized at the parse boundary, npm-name validation before registry lookups, dist-tags/ranges count as unpinned.

mcp-audit-v0.1.0

First release of @miaggy/mcp-audit: a static supply-chain audit of the MCP servers configured for Claude Desktop, Claude Code, Cursor, and VS Code. Five rules (unpinned versions incl. dist-tags/ranges, inline credentials, missing provenance, install scripts, low maintenance signals), skip findings for anything unauditable, posture report in markdown and single-file HTML. Read-only: never executes a discovered server. Built on @miaggy/core; published tokenless with provenance.

core-v0.2.0

Adds presence-only boolean CLI flags to createCli. No changes to the finding schema, scoring, or renderers.

core-v0.1.0

First release of @miaggy/core: the shared audit engine (finding schema, rule registry, catalog, posture scoring, injection signatures, report renderers, CLI/MCP scaffolding) extracted from bedrock-security-mcp v0.1.1 with behavior preserved. Published tokenless with provenance via Trusted Publishing.

bedrock-v0.2.0

bedrock-security-mcp now ships from the agent-sec-scanners monorepo, rebuilt on the extracted @miaggy/core engine. Behavior-preserving: byte-identical reports vs 0.1.x (golden-tested), same CLI flags, exit codes, MCP tools, and read-only AWS surface. No new rules.

bedrock-v0.2.0-rc.0

Release candidate: bedrock-security-mcp rebuilt on @miaggy/core@0.1.0. Behavior-preserving refactor — byte-identical reports vs 0.1.x (golden-tested), same CLI flags, exit codes, and MCP tools. Published under dist-tag next; latest remains 0.1.1 until 0.2.0 final.