Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@qlucent qlucent released this 25 Oct 16:53
· 1 commit to main since this release
v0.1.0
637f5bd

First release of the MCP config auditor.

Try it: qlucent.com/tools/mcp-audit in your browser, or locally:

npx @qlucent/mcp-audit
  • 20 rules: plaintext secrets, unpinned servers, shell execution, broad filesystem roots, plain-HTTP remotes and allow-all permissions.
  • Reads Claude Desktop, Claude Code, Cursor, VS Code (including user settings.json), Windsurf and Gemini CLI configs; finds them automatically when run with no arguments.
  • Flags dangerous combinations of tools, such as one that reads untrusted content alongside one that can send data out.
  • Secrets are masked in every output.
  • Table, Markdown and SARIF output; --fail-on for CI.
  • Runs locally and makes no network calls.

npm: https://www.npmjs.com/package/@qlucent/mcp-audit

Assets 2
Loading