vulkro mcp-audit
Checks the MCP configuration files of AI coding agents and assistants for risky servers and leaked credentials.
vulkro mcp-audit # project-local configs plus every known host config
vulkro mcp-audit ~/.cursor/mcp.json # one file
vulkro mcp-audit --require-mcp --fail-on critical,high # CI
With no path it reads ./.mcp.json, ./mcp.json and the known host locations: Claude Desktop, Cursor (~/.cursor/), Windsurf, VS Code (~/.vscode/mcp_settings.json), Cline, Gemini and Continue. Missing files are skipped. With a directory it reads only that directory's .mcp.json and mcp.json.
Flags
| Flag | Description |
|---|---|
-f, --format <FORMAT> | table (default), json, ndjson, sarif, junit, csv and the other scan formats. |
--fail-on <SEVERITIES> | Severities that cause exit 1. Default critical,high. |
--require-mcp | Exit 2 when no MCP config is found. |
--include-host | With an explicit path, also read the known host locations. |
--format json also carries an mcp_inventory object (paths checked, paths with configs, and each server's host, command and transport), so "nothing found" and "all clean" are distinguishable.
Rules
| ID | Rule |
|---|---|
| MCP-001 | Unpinned npx / uvx install. |
| MCP-002 | Git install on a mutable ref (HEAD, main, no ref). |
| MCP-003 | Filesystem server mounted at / or the home directory. |
| MCP-004 | Credential written into an env block instead of ${VAR}. |
| MCP-005 | http:// endpoint, or HTTPS with no visible auth. |
| MCP-006 | Pinned version matches a known compromised release. |
Exit codes
0 no findings (or no configs, without --require-mcp). 1 findings at or above --fail-on. 2 malformed JSON, IO failure, or no configs with --require-mcp.
See also: vulkro scan-mcp-server, vulkro extension-audit.