mcp-runtime-audit 0.1.0__py3-none-any.whl

mcp_audit/__init__.py

@@ -0,0 +1,4 @@
+"""mcp-audit: local runtime security scanner for MCP servers."""
+
+__version__ = "0.1.0"
+__all__ = ["__version__"]

mcp_audit/cli.py

@@ -0,0 +1,173 @@
+"""mcp-audit CLI: scan local MCP configs and optionally fix them."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from . import __version__
+from .scanners import (
+    agent_guard_link,
+    apply_fixes,
+    discover_configs,
+    load_config,
+    plan_fixes,
+    run_all_scans,
+)
+
+EXIT_OK = 0
+EXIT_FINDINGS = 1
+EXIT_ERROR = 2
+
+
+def _parse_args(argv):
+    parser = argparse.ArgumentParser(
+        prog="mcp-audit",
+        description="Local runtime security scanner for MCP servers.",
+    )
+    parser.add_argument("--version", action="version", version=__version__)
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan = sub.add_parser("scan", help="scan MCP configs for security issues")
+    scan.add_argument("--config", action="append", dest="configs",
+                      metavar="PATH", default=[],
+                      help="config file to scan (repeatable; defaults to "
+                           "~/.claude.json and other known locations)")
+    scan.add_argument("--format", choices=["text", "json"], default="text",
+                      help="output format")
+    scan.add_argument("--probe", action="store_true",
+                      help="send one unauthenticated GET to each http/sse "
+                           "endpoint to confirm reachability")
+    scan.add_argument("--timeout", type=float, default=4.0,
+                      help="probe timeout in seconds (default 4.0)")
+    scan.add_argument("--link-agent-guard", action="store_true",
+                      help="write critical servers into agent-guard's "
+                           "blocklist when it is installed")
+
+    fix = sub.add_parser("fix", help="print or apply one-click fixes")
+    fix.add_argument("--config", action="append", dest="configs",
+                     metavar="PATH", default=[],
+                     help="config file to fix (repeatable)")
+    fix.add_argument("--apply", action="store_true",
+                     help="write the fixes to the config file (backs up "
+                          "first); without it only prints the plan")
+    return parser.parse_args(argv)
+
+
+def _load_all(paths):
+    servers, errors = [], []
+    for path in paths:
+        svcs, err = load_config(path)
+        if err:
+            errors.append(err)
+        servers.extend(svcs)
+    return servers, errors
+
+
+def _format_text(findings, errors, n_servers, n_configs):
+    lines = []
+    if errors:
+        for e in errors:
+            lines.append("error: %s" % e)
+    if not findings:
+        lines.append("mcp-audit: %d server(s) in %d config(s): no findings"
+                     % (n_servers, n_configs))
+        return "\n".join(lines)
+    sev_max = findings[0].severity
+    lines.append("mcp-audit: %d finding(s) across %d server(s) "
+                 "(worst: %s):" % (len(findings), n_servers, sev_max))
+    for f in findings:
+        cve = " [%s]" % f.cve_id if f.cve_id else ""
+        lines.append("[%s]%s %s (%s): %s"
+                     % (f.severity.upper(), cve, f.rule_id, f.server, f.evidence))
+        lines.append("  fix: %s" % f.fix)
+    return "\n".join(lines)
+
+
+def cmd_scan(args):
+    paths = discover_configs(args.configs)
+    if not paths:
+        msg = {"findings": [], "errors": ["no config files found"],
+               "summary": {"servers": 0, "configs": 0}}
+        if args.format == "json":
+            print(json.dumps(msg, indent=2))
+        else:
+            print("mcp-audit: no MCP config files found "
+                  "(checked ~/.claude.json, ~/.codex/config.json, "
+                  "~/.config/mcp/servers.json, ~/.mcp.json); "
+                  "pass --config PATH to scan a specific file")
+        return EXIT_ERROR
+    servers, errors = _load_all(paths)
+    findings = run_all_scans(servers, probe=args.probe, timeout=args.timeout)
+    if args.link_agent_guard and findings:
+        linked, msg = agent_guard_link(findings)
+        if args.format == "json":
+            pass  # message folded into output below
+        else:
+            print(msg)
+    if args.format == "json":
+        print(json.dumps({
+            "findings": [f.to_dict() for f in findings],
+            "errors": errors,
+            "summary": {
+                "servers": len(servers),
+                "configs": len(paths),
+                "findings": len(findings),
+                "worst": findings[0].severity if findings else None,
+            },
+        }, indent=2))
+    else:
+        print(_format_text(findings, errors, len(servers), len(paths)))
+    if errors and not servers:
+        return EXIT_ERROR
+    return EXIT_FINDINGS if findings else EXIT_OK
+
+
+def cmd_fix(args):
+    paths = discover_configs(args.configs)
+    if not paths:
+        print("mcp-audit: no MCP config files found; pass --config PATH")
+        return EXIT_ERROR
+    rc = EXIT_OK
+    for path in paths:
+        servers, errors = _load_all([path])
+        findings = run_all_scans(servers)
+        plan, missing = plan_fixes(path, findings) if not errors else ([], [])
+        if args.apply:
+            if errors:
+                print("%s: error: %s" % (path, errors[0]))
+                rc = EXIT_ERROR
+                continue
+            if not plan:
+                print("%s: nothing fixable" % path)
+                continue
+            backup, applied = apply_fixes(path, findings)
+            print("%s: applied %d fix(es); backup at %s"
+                  % (path, applied, backup))
+        else:
+            print("%s:" % path)
+            if not plan and not missing:
+                print("  nothing fixable")
+            for item in plan:
+                print("  - [%s] %s: %s" % (
+                    item["rule_id"], item["server"], item["action"]))
+            for name in missing:
+                print("  - %s: server not found in config (skipped)" % name)
+            if plan:
+                print("  re-run with --apply to write these fixes "
+                      "(config is backed up first)")
+    return rc
+
+
+def main(argv=None):
+    args = _parse_args(argv if argv is not None else sys.argv[1:])
+    if args.command == "scan":
+        return cmd_scan(args)
+    if args.command == "fix":
+        return cmd_fix(args)
+    return EXIT_ERROR
+
+
+if __name__ == "__main__":
+    sys.exit(main())

mcp_audit/cve_db.py

@@ -0,0 +1,215 @@
+"""Bundled known-CVE table for MCP servers and MCP-adjacent tooling.
+
+This is a best-effort advisory snapshot (bundled 2026-10). Affected
+version ranges come from public advisories; re-check NVD / vendor
+releases before using these for compliance reporting.
+"""
+
+from __future__ import annotations
+
+CVE_DB = [
+    {
+        "id": "CVE-2025-49596",
+        "title": "MCP Inspector proxy unauthenticated RCE",
+        "cvss": 9.4,
+        "severity": "critical",
+        "products": ["@modelcontextprotocol/inspector", "mcp-inspector"],
+        "affected": "<0.14.1",
+        "fixed_in": "0.14.1",
+        "description": (
+            "The MCP Inspector proxy (default port 6277) accepted an "
+            "unauthenticated request to /sse with transportType=stdio and "
+            "arbitrary command/args, spawning the command as a local "
+            "subprocess. A malicious web page could drive it cross-origin "
+            "(0.0.0.0-day / DNS rebinding), so visiting a page was enough "
+            "to execute code on the developer's machine."
+        ),
+        "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2025-49596",
+            "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g",
+        ],
+    },
+    {
+        "id": "CVE-2026-76404",
+        "title": "Splunk MCP Server unsafe deserialization RCE",
+        "cvss": 9.1,
+        "severity": "critical",
+        "products": ["splunk-mcp-server", "@splunk/mcp-server"],
+        "affected": "<1.2.1",
+        "fixed_in": "1.2.1",
+        "description": (
+            "The Splunk MCP Server app's credential-management component "
+            "deserialized stored data without type validation (CWE-502). "
+            "A user holding the Splunk admin role could execute arbitrary "
+            "OS commands on the host. Splunk advisory SVD-2026-0808."
+        ),
+        "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-76404",
+        ],
+    },
+    {
+        "id": "CVE-2026-58201",
+        "title": "Lokka Microsoft 365 MCP Server SSRF",
+        "cvss": None,
+        "severity": "high",
+        "products": ["lokka", "lokka-microsoft"],
+        "affected": "<2.1.2",
+        "fixed_in": "2.1.2",
+        "description": (
+            "Lokka's Lokka-Microsoft tool built Azure Resource Manager "
+            "request URLs by concatenating a user-supplied path onto the "
+            "management.azure.com base string (CWE-918). A crafted path "
+            "could redirect a valid ARM Bearer token to an "
+            "attacker-controlled host."
+        ),
+        "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-58201",
+        ],
+    },
+    {
+        "id": "CVE-2026-105697",
+        "title": "Langflow MCP stdio transport RCE (bash -c wrapper)",
+        "cvss": 9.9,
+        "severity": "critical",
+        "products": ["langflow", "langflow-base", "lfx"],
+        "affected": "<1.10.3",
+        "fixed_in": "1.10.3",
+        "description": (
+            "Before 1.10.3 the MCP stdio transport launched whatever "
+            "command/args a user put in an MCP server configuration with "
+            "no allowlist, wrapped in `bash -c \"exec {command} ...\"` "
+            "(CWE-78). With the default LANGFLOW_AUTO_LOGIN=true, an "
+            "unauthenticated attacker could add a malicious MCP server and "
+            "get remote code execution on the Langflow host."
+        ),
+        "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-105697",
+        ],
+    },
+    {
+        "id": "CVE-2026-89039",
+        "title": "MCP server RCE (advisory, see NVD for product mapping)",
+        "cvss": None,
+        "severity": "high",
+        "products": [],
+        "affected": None,
+        "fixed_in": None,
+        "description": (
+            "Known CVE in the MCP ecosystem. Product/version mapping not "
+            "bundled in this snapshot; check the NVD entry and vendor "
+            "advisories for affected versions."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-89039"],
+    },
+    {
+        "id": "CVE-2026-105793",
+        "title": "MCP server vulnerability (advisory, see NVD for product mapping)",
+        "cvss": None,
+        "severity": "high",
+        "products": [],
+        "affected": None,
+        "fixed_in": None,
+        "description": (
+            "Known CVE in the MCP ecosystem. Product/version mapping not "
+            "bundled in this snapshot; check the NVD entry and vendor "
+            "advisories for affected versions."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-105793"],
+    },
+    {
+        "id": "CVE-2026-94486",
+        "title": "MCP server vulnerability (advisory, see NVD for product mapping)",
+        "cvss": None,
+        "severity": "high",
+        "products": [],
+        "affected": None,
+        "fixed_in": None,
+        "description": (
+            "Known CVE in the MCP ecosystem. Product/version mapping not "
+            "bundled in this snapshot; check the NVD entry and vendor "
+            "advisories for affected versions."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-94486"],
+    },
+    {
+        "id": "CVE-2026-19807",
+        "title": "MCP server vulnerability (advisory, see NVD for product mapping)",
+        "cvss": None,
+        "severity": "high",
+        "products": [],
+        "affected": None,
+        "fixed_in": None,
+        "description": (
+            "Known CVE in the MCP ecosystem. Product/version mapping not "
+            "bundled in this snapshot; check the NVD entry and vendor "
+            "advisories for affected versions."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-19807"],
+    },
+]
+
+
+def get_cve(cve_id: str):
+    """Return the CVE entry for *cve_id*, or None."""
+    for entry in CVE_DB:
+        if entry["id"] == cve_id:
+            return entry
+    return None
+
+
+def _version_tuple(version: str):
+    """Convert a version string to a comparable tuple of ints.
+
+    Non-numeric parts are dropped, so "1.10.3a" -> (1, 10, 3).
+    """
+    parts = []
+    for chunk in str(version).split("."):
+        digits = "".join(c for c in chunk if c.isdigit())
+        if digits:
+            parts.append(int(digits))
+        else:
+            parts.append(0)
+    return tuple(parts)
+
+
+def version_matches_affected(version: str, affected: str) -> bool:
+    """Evaluate a constraint like '<0.14.1' against a version string."""
+    for op in ("<=", ">=", "==", "<", ">"):
+        if affected.startswith(op):
+            bound = affected[len(op):].strip()
+            v, b = _version_tuple(version), _version_tuple(bound)
+            # Pad shorter tuple so (1, 2) compares sanely with (1, 2, 1).
+            width = max(len(v), len(b))
+            v += (0,) * (width - len(v))
+            b += (0,) * (width - len(b))
+            if op == "<":
+                return v < b
+            if op == "<=":
+                return v <= b
+            if op == ">":
+                return v > b
+            if op == ">=":
+                return v >= b
+            return v == b
+    raise ValueError("unsupported constraint: %r" % affected)
+
+
+def affected_cves(product: str, version: str):
+    """Return CVE entries whose product list contains *product* and whose
+    version range covers *version*. Matching is case-insensitive."""
+    hits = []
+    if not product or not version:
+        return hits
+    name = product.strip().lower()
+    for entry in CVE_DB:
+        if entry["affected"] is None:
+            continue
+        aliases = [p.lower() for p in entry.get("products", [])]
+        if name not in aliases:
+            continue
+        try:
+            if version_matches_affected(version, entry["affected"]):
+                hits.append(entry)
+        except (ValueError, TypeError):
+            continue
+    return hits

mcp_audit/scanners.py

@@ -0,0 +1,502 @@
+"""Config discovery, parsing, and security scanners for mcp-audit."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import socket
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass, field
+
+from .cve_db import affected_cves
+
+# ---------------------------------------------------------------- config I/O
+
+DEFAULT_CONFIG_PATHS = [
+    os.path.expanduser("~/.claude.json"),
+    os.path.expanduser("~/.codex/config.json"),
+    os.path.expanduser("~/.config/mcp/servers.json"),
+    os.path.expanduser("~/.mcp.json"),
+]
+
+
+@dataclass
+class McpServer:
+    """One server entry parsed from a config file."""
+
+    name: str
+    transport: str  # "stdio" | "sse" | "http" | "unknown"
+    command: str = ""
+    args: list = field(default_factory=list)
+    env: dict = field(default_factory=dict)
+    url: str = ""
+    headers: dict = field(default_factory=dict)
+    version: str = ""
+    package: str = ""
+    source_file: str = ""
+
+
+@dataclass
+class Finding:
+    rule_id: str
+    cve_id: str
+    severity: str  # critical | high | medium | low | info
+    server: str
+    evidence: str
+    fix: str
+    source_file: str = ""
+
+    def to_dict(self):
+        return {
+            "rule_id": self.rule_id,
+            "cve_id": self.cve_id,
+            "severity": self.severity,
+            "server": self.server,
+            "evidence": self.evidence,
+            "fix": self.fix,
+            "source_file": self.source_file,
+        }
+
+
+def _servers_from_entry(name, entry, source_file=""):
+    srv = McpServer(name=name, transport="unknown", source_file=source_file)
+    if not isinstance(entry, dict):
+        return srv
+    srv.command = str(entry.get("command", "") or "")
+    args = entry.get("args", [])
+    srv.args = [str(a) for a in args] if isinstance(args, list) else []
+    env = entry.get("env", {})
+    srv.env = dict(env) if isinstance(env, dict) else {}
+    srv.url = str(entry.get("url", "") or "")
+    headers = entry.get("headers", {})
+    srv.headers = dict(headers) if isinstance(headers, dict) else {}
+    srv.version = str(entry.get("version", "") or "")
+
+    if srv.url:
+        parsed = urllib.parse.urlparse(srv.url)
+        if parsed.scheme in ("http", "https"):
+            srv.transport = "sse" if parsed.path.endswith("/sse") or "sse" in parsed.path else "http"
+    elif srv.command:
+        srv.transport = "stdio"
+
+    srv.package, srv.version = _infer_package(srv) or (srv.package, srv.version or "")
+    return srv
+
+
+_PKG_RE = re.compile(r"^([@a-zA-Z0-9_.\-/]+?)(?:@([0-9][0-9A-Za-z.\-]*))?$")
+
+
+def _infer_package(srv):
+    """Guess (package, version) from an npx/uvx/node invocation.
+
+    Handles args like ["-y", "@modelcontextprotocol/inspector@0.13.0"]
+    or ["mcp-server-foo@1.2.3", ...].
+    """
+    tokens = [srv.command] + list(srv.args)
+    for tok in tokens:
+        tok = tok.strip()
+        if tok.startswith("-"):
+            continue
+        m = _PKG_RE.match(tok)
+        if not m:
+            continue
+        name, ver = m.group(1), m.group(2)
+        if "/" in name or name.startswith("@") or re.fullmatch(r"[a-zA-Z0-9_.\-]+", name):
+            if ver:
+                return name, ver
+    return None
+
+
+def _walk_mcp_servers(obj, source_file=""):
+    """Extract mcpServers dicts from a parsed JSON config."""
+    found = []
+    if isinstance(obj, dict):
+        if "mcpServers" in obj and isinstance(obj["mcpServers"], dict):
+            for name, entry in obj["mcpServers"].items():
+                found.append(_servers_from_entry(name, entry, source_file))
+        for key in ("servers", "mcp_servers"):
+            if key in obj and isinstance(obj[key], dict):
+                for name, entry in obj[key].items():
+                    found.append(_servers_from_entry(name, entry, source_file))
+        # Recurse into nested dicts (e.g. Claude Code's per-project blocks
+        # inside ~/.claude.json) to avoid missing nested mcpServers.
+        for key, value in obj.items():
+            if key in ("mcpServers", "servers", "mcp_servers"):
+                continue
+            if isinstance(value, dict):
+                found.extend(_walk_mcp_servers(value, source_file))
+    return found
+
+
+def load_config(path):
+    """Load one config file, return (servers, error_message)."""
+    try:
+        with open(path, encoding="utf-8") as fh:
+            data = json.load(fh)
+    except (OSError, json.JSONDecodeError) as exc:
+        return [], "cannot read %s: %s" % (path, exc)
+    return _walk_mcp_servers(data, path), ""
+
+
+def discover_configs(explicit=None):
+    """Return list of config paths: explicit ones, else existing defaults."""
+    if explicit:
+        return list(explicit)
+    return [p for p in DEFAULT_CONFIG_PATHS if os.path.isfile(p)]
+
+# ------------------------------------------------------------ rule 1: stdio
+
+# Shell-wrapper patterns that turn a stdio config into command injection.
+SHELL_PATTERNS = [
+    (re.compile(r"(^|\s)bash\s+-c(\s|$)", re.I), "bash -c"),
+    (re.compile(r"(^|\s)sh\s+-c(\s|$)", re.I), "sh -c"),
+    (re.compile(r"(^|\s)zsh\s+-c(\s|$)", re.I), "zsh -c"),
+    (re.compile(r"(^|\s)(cmd|powershell|pwsh)(\.exe)?\s+(/[cC]|-c|-Command)(\s|$)"), "cmd /c"),
+    (re.compile(r"&&|\|\||;\s*(curl|wget|rm|chmod|nc|ncat)\b", re.I), "command chaining"),
+]
+
+
+def scan_dangerous_stdio(servers):
+    """Flag stdio servers whose command/args wrap execution in a shell."""
+    findings = []
+    for srv in servers:
+        if srv.transport != "stdio":
+            continue
+        invocation = " ".join([srv.command] + list(srv.args))
+        for pattern, label in SHELL_PATTERNS:
+            if pattern.search(invocation):
+                findings.append(
+                    Finding(
+                        rule_id="STDIO-SHELL",
+                        cve_id="CVE-2026-105697",
+                        severity="high",
+                        server=srv.name,
+                        evidence="stdio server %r runs through shell wrapper %s: %s"
+                        % (srv.name, label, invocation[:200]),
+                        fix="Remove the shell wrapper: set command to the real "
+                        "executable and pass each argument separately in args. "
+                        "Never pass untrusted input into a shell -c string.",
+                        source_file=srv.source_file,
+                    )
+                )
+                break
+    return findings
+
+# ------------------------------------------------- rule 2: unauth endpoints
+
+
+def _probe_endpoint(url, timeout=4.0):
+    """Send one unauthenticated GET. Returns (reachable, status, detail).
+
+    reachable=True means the endpoint answered *without* any credentials —
+    the unauthenticated-reachability signal this scanner is built to detect.
+    """
+    req = urllib.request.Request(url, headers={"User-Agent": "mcp-audit/0.1.0"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            return True, resp.status, "HTTP %s" % resp.status
+    except urllib.error.HTTPError as exc:
+        if exc.code in (401, 403, 407):
+            return False, exc.code, "HTTP %s (auth required)" % exc.code
+        return True, exc.code, "HTTP %s (reachable without auth)" % exc.code
+    except urllib.error.URLError as exc:
+        return False, 0, "unreachable: %s" % exc.reason
+    except (socket.timeout, OSError) as exc:
+        return False, 0, "unreachable: %s" % exc
+
+
+def scan_unauthenticated_endpoints(servers, timeout=4.0, probe=False):
+    """Flag http/sse servers reachable with no authentication.
+
+    probe=False (default): static config check — flags non-loopback URLs
+    with no Authorization/Api-Key header. probe=True: also sends one
+    unauthenticated GET to confirm the endpoint answers.
+    """
+    findings = []
+    for srv in servers:
+        if srv.transport not in ("sse", "http") or not srv.url:
+            continue
+        host = urllib.parse.urlparse(srv.url).hostname or ""
+        has_auth = any(
+            k.lower() in ("authorization", "x-api-key", "x-auth-token", "cookie")
+            for k in srv.headers
+        )
+        evidence_bits = []
+        if probe:
+            reachable, status, detail = _probe_endpoint(srv.url, timeout=timeout)
+            if reachable:
+                evidence_bits.append("unauthenticated GET -> %s" % detail)
+        else:
+            reachable = host not in ("", "127.0.0.1", "::1", "localhost")
+            evidence_bits.append("no auth header configured")
+        if reachable and not has_auth:
+            findings.append(
+                Finding(
+                    rule_id="UNAUTH-ENDPOINT",
+                    cve_id="CVE-2025-49596",
+                    severity="critical" if probe else "high",
+                    server=srv.name,
+                    evidence="server %r exposes %s: %s"
+                    % (srv.name, srv.url, "; ".join(evidence_bits)),
+                    fix="Require authentication: put the endpoint behind an "
+                    "auth proxy or add headers={\"Authorization\": \"Bearer ${MCP_TOKEN}\"} "
+                    "to the config and rotate the token.",
+                    source_file=srv.source_file,
+                )
+            )
+    return findings
+
+# ------------------------------------------------------ rule 3: bind address
+
+BIND_RE = re.compile(r"--?(?:bind|host|listen)(?:-address)?[= ]\s*([0-9a-zA-Z.:]+)")
+PUBLIC_HOSTS = {"0.0.0.0", "::"}
+
+
+def scan_bind_address(servers):
+    """Flag servers bound to all interfaces (0.0.0.0 / ::)."""
+    findings = []
+    for srv in servers:
+        hits = []
+        if srv.url:
+            host = urllib.parse.urlparse(srv.url).hostname or ""
+            if host in PUBLIC_HOSTS:
+                hits.append("url host %s" % host)
+        invocation = " ".join([srv.command] + list(srv.args))
+        for m in BIND_RE.finditer(invocation):
+            if m.group(1) in PUBLIC_HOSTS:
+                hits.append("flag %s=%s" % (m.group(0), m.group(1)))
+        for value in srv.env.values():
+            if str(value).strip() in PUBLIC_HOSTS:
+                hits.append("env value %s" % value)
+        for hit in hits:
+            findings.append(
+                Finding(
+                    rule_id="BIND-ADDR",
+                    cve_id="CVE-2025-49596",
+                    severity="high",
+                    server=srv.name,
+                    evidence="server %r binds to all interfaces (%s); "
+                    "reachable beyond localhost" % (srv.name, hit),
+                    fix="Bind to 127.0.0.1 instead of 0.0.0.0: e.g. replace "
+                    "--host 0.0.0.0 with --host 127.0.0.1. "
+                    "mcp-audit fix --apply does this automatically.",
+                    source_file=srv.source_file,
+                )
+            )
+    return findings
+
+# ------------------------------------------------------ rule 4: known CVEs
+
+
+def scan_known_cves(servers):
+    """Flag servers running package versions hit by the bundled CVE table."""
+    findings = []
+    for srv in servers:
+        if not srv.package:
+            continue
+        for entry in affected_cves(srv.package, srv.version):
+            findings.append(
+                Finding(
+                    rule_id="KNOWN-CVE",
+                    cve_id=entry["id"],
+                    severity=entry["severity"],
+                    server=srv.name,
+                    evidence="server %r runs %s@%s, affected by %s (%s, CVSS %s)"
+                    % (
+                        srv.name,
+                        srv.package,
+                        srv.version,
+                        entry["id"],
+                        entry["title"],
+                        entry.get("cvss") or "?",
+                    ),
+                    fix="Upgrade to %s or later, then restart the server. "
+                    "Refs: %s"
+                    % (entry.get("fixed_in") or "a patched version",
+                       ", ".join(entry.get("references", [])) or "see NVD"),
+                    source_file=srv.source_file,
+                )
+            )
+    return findings
+
+# ------------------------------------------------------------ orchestration
+
+SEVERITY_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
+
+
+def run_all_scans(servers, probe=False, timeout=4.0):
+    findings = []
+    findings += scan_dangerous_stdio(servers)
+    findings += scan_unauthenticated_endpoints(servers, timeout=timeout, probe=probe)
+    findings += scan_bind_address(servers)
+    findings += scan_known_cves(servers)
+    findings.sort(key=lambda f: (SEVERITY_ORDER.get(f.severity, 5), f.server))
+    return findings
+
+# ------------------------------------------------------------ one-click fix
+
+FIXABLE_RULES = {"BIND-ADDR", "UNAUTH-ENDPOINT"}
+
+
+def _apply_bind_fix(entry):
+    """Rewrite 0.0.0.0 / :: bindings to 127.0.0.1 in url, args, env."""
+    changed = False
+    if isinstance(entry.get("url"), str):
+        url = entry["url"]
+        new_url = re.sub(r"://(0\.0\.0\.0|::)(:|/)", r"://127.0.0.1\2", url)
+        if new_url != url:
+            entry["url"] = new_url
+            changed = True
+    args = entry.get("args")
+    if isinstance(args, list):
+        i = 0
+        while i < len(args):
+            arg = args[i]
+            if isinstance(arg, str):
+                if re.fullmatch(r"--?(?:host|bind|listen)(?:-address)?", arg):
+                    nxt = args[i + 1] if i + 1 < len(args) else None
+                    if nxt in ("0.0.0.0", "::"):
+                        args[i + 1] = "127.0.0.1"
+                        changed = True
+                else:
+                    fixed = re.sub(
+                        r"^(--?(?:host|bind|listen)(?:-address)?)=(0\.0\.0\.0|::)$",
+                        r"\1=127.0.0.1",
+                        arg,
+                    )
+                    if fixed != arg:
+                        args[i] = fixed
+                        changed = True
+            i += 1
+    env = entry.get("env")
+    if isinstance(env, dict):
+        for k, v in env.items():
+            if str(v).strip() in PUBLIC_HOSTS:
+                env[k] = "127.0.0.1"
+                changed = True
+    return changed
+
+
+def _apply_auth_fix(entry):
+    if not isinstance(entry.get("headers"), dict):
+        entry["headers"] = {}
+    if not any(
+        k.lower() in ("authorization", "x-api-key", "x-auth-token", "cookie")
+        for k in entry["headers"]
+    ):
+        entry["headers"]["Authorization"] = "Bearer ${MCP_TOKEN}"
+        return True
+    return False
+
+
+def plan_fixes(path, findings):
+    """Build a fix plan for one config file. Returns (plan, missing_servers)."""
+    with open(path, encoding="utf-8") as fh:
+        data = json.load(fh)
+    containers = []
+    for key in ("mcpServers", "servers", "mcp_servers"):
+        if key in data and isinstance(data[key], dict):
+            containers.append((key, data[key]))
+
+    plan = []
+    done = set()
+    for f in findings:
+        if f.rule_id not in FIXABLE_RULES:
+            continue
+        for ckey, container in containers:
+            if f.server in container and (f.server, f.rule_id) not in done:
+                plan.append(
+                    {
+                        "server": f.server,
+                        "rule_id": f.rule_id,
+                        "container": ckey,
+                        "action": (
+                            "bind 0.0.0.0 -> 127.0.0.1"
+                            if f.rule_id == "BIND-ADDR"
+                            else 'add Authorization: Bearer ${MCP_TOKEN} placeholder header'
+                        ),
+                    }
+                )
+                done.add((f.server, f.rule_id))
+    missing = [f.server for f in findings
+               if f.rule_id in FIXABLE_RULES and (f.server, f.rule_id) not in done]
+    return plan, missing
+
+
+def apply_fixes(path, findings):
+    """Apply fixes to a config file. Returns (backup_path, applied_count)."""
+    with open(path, encoding="utf-8") as fh:
+        data = json.load(fh)
+
+    plan, _ = plan_fixes(path, findings)
+    if not plan:
+        return "", 0
+
+    backup_path = "%s.bak-%s" % (path, time.strftime("%Y%m%d-%H%M%S"))
+    with open(backup_path, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2)
+
+    applied = 0
+    for item in plan:
+        container = data.get(item["container"], {})
+        entry = container.get(item["server"])
+        if not isinstance(entry, dict):
+            continue
+        if item["rule_id"] == "BIND-ADDR" and _apply_bind_fix(entry):
+            applied += 1
+        elif item["rule_id"] == "UNAUTH-ENDPOINT" and _apply_auth_fix(entry):
+            applied += 1
+
+    with open(path, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2)
+        fh.write("\n")
+    return backup_path, applied
+
+# -------------------------------------------------- agent-guard integration
+
+AGENT_GUARD_CONFIG_PATHS = [
+    os.path.expanduser("~/.agent-guard/config.json"),
+    os.path.expanduser("~/.config/agent-guard/config.json"),
+    os.path.expanduser("~/.agent-guard.json"),
+]
+
+
+def agent_guard_link(findings):
+    """Link critical findings into agent-guard's blocklist.
+
+    Returns (linked, message): linked=True when an agent-guard config was
+    found and updated; otherwise prints the manual linking instruction.
+    """
+    critical = sorted({f.server for f in findings if f.severity == "critical"})
+    if not critical:
+        return False, "no critical servers to link"
+    for path in AGENT_GUARD_CONFIG_PATHS:
+        if not os.path.isfile(path):
+            continue
+        try:
+            with open(path, encoding="utf-8") as fh:
+                cfg = json.load(fh)
+        except (OSError, json.JSONDecodeError):
+            continue
+        blocked = cfg.setdefault("blocked_servers", [])
+        added = 0
+        for name in critical:
+            if name not in blocked:
+                blocked.append(name)
+                added += 1
+        if added:
+            backup = "%s.bak-%s" % (path, time.strftime("%Y%m%d-%H%M%S"))
+            os.replace(path, backup)
+            with open(path, "w", encoding="utf-8") as fh:
+                json.dump(cfg, fh, indent=2)
+        return True, "linked %d critical server(s) to %s: %s" % (
+            added, path, ", ".join(critical))
+    return False, (
+        "agent-guard config not found. Manual link: add %s to "
+        "agent-guard's blocked_servers list (or run "
+        "'agent-guard block %s')." % (", ".join(critical), critical[0])
+    )

mcp_runtime_audit-0.1.0.dist-info/METADATA

@@ -0,0 +1,173 @@
+Metadata-Version: 2.4
+Name: mcp-runtime-audit
+Version: 0.1.0
+Summary: Local runtime security scanner for MCP servers — known-CVE checks, one-click fixes
+Author-email: hao li <haoli5933@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/hahahahahahahahah6/mcp-audit
+Keywords: mcp,security,scanner,cli,cve
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# mcp-audit
+
+A local runtime security scanner for MCP servers. Point it at your MCP client
+configs and it flags the misconfigurations and known vulnerabilities that
+actually get exploited — then offers one-click fixes. Zero third-party
+dependencies, Python >= 3.9.
+
+```bash
+pip install mcp-runtime-audit
+mcp-audit scan
+```
+
+## Why this exists
+
+MCP servers run with your user's privileges and are driven by an AI agent on
+your behalf — which makes them a very different threat surface from a library
+you import. The evidence so far is not reassuring:
+
+- **The official tooling itself has shipped RCE.** CVE-2025-49596 hit
+  Anthropic's MCP Inspector (CVSS 9.4): its local proxy accepted an
+  unauthenticated `/sse` request with `transportType=stdio&command=<cmd>` and
+  spawned it as a subprocess — visiting a malicious page was enough to run
+  code on the developer's machine. Fixed in Inspector 0.14.1.
+- **Enterprise MCP apps are not immune.** CVE-2026-76404 (Splunk MCP Server
+  < 1.2.1, CVSS 9.1): unsafe deserialization in credential management let an
+  admin-role user execute arbitrary OS commands (Splunk advisory
+  SVD-2026-0808).
+- **Anthropic treats stdio risk as "expected"** — the position is that the
+  security burden sits with whoever deploys the server, not the protocol.
+  That leaves every local config file as the real security boundary, and
+  those files are hand-edited JSON.
+- **Unpatched servers are out there in production.** Five US federal
+  government MCP servers were found running unpatched, and internet-wide
+  scans keep turning up thousands of exposed MCP endpoints, the vast majority
+  without any authentication.
+
+Nobody audits their own `~/.claude.json` by hand. mcp-audit does it in a
+second, in CI-friendly form.
+
+## How it differs
+
+| Tool | Known-CVE version checks | One-click fixes | Focus |
+|------|--------------------------|-----------------|-------|
+| **mcp-audit** | ✅ bundled CVE table | ✅ `fix --apply` | runtime security |
+| mcpscan | ❌ | ❌ | static config scanning |
+| graygnatconsole mcp-audit-tool | ❌ | ❌ | config auditing |
+| mcp-lint | n/a | n/a | **design quality** linting, not runtime security — no overlap |
+
+mcpscan and graygnatconsole's mcp-audit-tool scan configs but neither maps
+your installed server versions against known CVEs, and neither writes fixes
+back. mcp-lint is a design-quality linter for MCP servers; mcp-audit is a
+runtime security scanner for the servers you run — different layer, no
+overlap.
+
+## Quick start
+
+```bash
+pip install mcp-runtime-audit
+
+# scan default locations (~/.claude.json, ~/.codex/config.json,
+# ~/.config/mcp/servers.json, ~/.mcp.json)
+mcp-audit scan
+
+# scan a specific file, JSON output for CI
+mcp-audit scan --config ~/my-claude.json --format json
+
+# confirm unauthenticated reachability with a live probe
+# (one unauthenticated GET per endpoint)
+mcp-audit scan --probe
+
+# preview fixes (dry run), then apply them (backs up first)
+mcp-audit fix --config ~/.claude.json
+mcp-audit fix --config ~/.claude.json --apply
+```
+
+Exit codes: `0` clean, `1` findings, `2` errors — CI-ready.
+
+## What it checks
+
+1. **Dangerous stdio commands (`STDIO-SHELL`, high).** A stdio entry wrapping
+   execution in `bash -c` / `sh -c` / `cmd /c` is command injection by
+   design — this is the Langflow CVE-2026-105697 pattern (CVSS 9.9). Flags
+   the server and shows the exact invocation.
+2. **Unauthenticated SSE/HTTP endpoints (`UNAUTH-ENDPOINT`,
+   critical with `--probe`).** Endpoints with no `Authorization`/`X-API-Key`
+   header. `--probe` sends one unauthenticated GET to confirm the endpoint
+   actually answers — the CVE-2025-49596 shape.
+3. **Bind addresses (`BIND-ADDR`, high).** Servers bound to `0.0.0.0` or `::`
+   in URLs, `--host` flags, or env vars are reachable beyond localhost.
+4. **Known-CVE version checks (`KNOWN-CVE`, per-CVE severity).** Extracts
+   `package@version` from `npx`/`uvx` invocations and matches against the
+   bundled CVE table below.
+
+Every finding carries a rule id, CVE id, severity, the evidence, and the fix
+command — in both text and JSON output.
+
+### One-click fix
+
+`mcp-audit fix` defaults to a dry-run plan. With `--apply` it:
+
+- rewrites `0.0.0.0` → `127.0.0.1` in URLs, `--host` flags, and env values,
+- adds an `Authorization: Bearer ${MCP_TOKEN}` placeholder header to
+  unauthenticated endpoints (you fill in a real token),
+- backs up the config to `<file>.bak-<timestamp>` before writing,
+- links critical servers into agent-guard's `blocked_servers` list when an
+  agent-guard config is detected (see below).
+
+### agent-guard integration
+
+`mcp-audit scan --link-agent-guard` writes every critical server into
+agent-guard's blocklist (config backed up first). If agent-guard isn't
+installed, it prints the manual linking instruction instead.
+
+## CVE table
+
+Bundled advisory snapshot (2026-10). Re-check NVD / vendor releases before
+using these for compliance reporting.
+
+| CVE | Product | Affected | Fix | Class |
+|-----|---------|----------|-----|-------|
+| CVE-2025-49596 | @modelcontextprotocol/inspector | < 0.14.1 | 0.14.1 | Unauthenticated RCE, CVSS 9.4 |
+| CVE-2026-76404 | splunk-mcp-server | < 1.2.1 | 1.2.1 | Unsafe deserialization RCE, CVSS 9.1 |
+| CVE-2026-58201 | lokka (M365 MCP) | < 2.1.2 | 2.1.2 | SSRF leaking ARM bearer token |
+| CVE-2026-105697 | langflow / langflow-base / lfx | < 1.10.3 | 1.10.3 | MCP stdio `bash -c` RCE, CVSS 9.9 |
+| CVE-2026-89039 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-105793 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-94486 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-19807 | (product mapping pending) | — | — | See NVD |
+
+## CI example
+
+```yaml
+# .github/workflows/mcp-audit.yml
+- uses: actions/setup-python@v5
+  with: { python-version: "3.12" }
+- run: pip install mcp-runtime-audit
+- run: mcp-audit scan --config ./mcp-servers.json --format json
+# exits 1 on findings -> fails the build
+```
+
+## Limitations
+
+- Version detection reads `package@version` from your config's command/args
+  (npx/uvx/node style). Servers installed another way, or without a pinned
+  version, won't match the CVE table.
+- `--probe` sends one unauthenticated GET per endpoint — no auth bypass
+  attempts, no payloads, and it never mutates anything. It still touches
+  the network; don't run it against hosts you don't own.
+- The CVE table is a bundled snapshot, not a live feed. New CVEs need a new
+  release.
+- Static checks can't see what a server does after it starts (dynamic tool
+  behavior, prompt injection in tool outputs). This is a config/runtime
+  surface scanner, not a runtime behavior monitor.
+
+## License
+
+MIT.

mcp_runtime_audit-0.1.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+mcp_audit/__init__.py,sha256=jUN7XHOBjzPLz6d_Svx255fSoae4MdxYU5GKgOxT4yQ,114
+mcp_audit/cli.py,sha256=WZN85swe6uy3QnJAYOKgmmrvathi1nsAciN1UpsXl3Q,6249
+mcp_audit/cve_db.py,sha256=KBWKd6ds1dt7HdShhezZU8Opr80PZ6zu11OK4F1SIpc,7925
+mcp_audit/scanners.py,sha256=l72OJYhi4hKqj1cb_ert3Pef4EGm81wpCp34hNRBaT0,18508
+mcp_runtime_audit-0.1.0.dist-info/licenses/LICENSE,sha256=OYhQDg7nxWoFtnF6J8NkFUA8NMw5TKv9a1WTXHY-fu4,1063
+mcp_runtime_audit-0.1.0.dist-info/METADATA,sha256=SpP_Xw8gNwaSoDnHpIcjj7s72XxD3P93UEdh7hh0M9Q,7246
+mcp_runtime_audit-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mcp_runtime_audit-0.1.0.dist-info/entry_points.txt,sha256=gNxxZPRoXCWu3pELYwSNWSoyuBdKWbh153_eozNW5Jg,49
+mcp_runtime_audit-0.1.0.dist-info/top_level.txt,sha256=YZ4Gy-ehEA074nfIt4cMSAS6gAJDYcWfX0gu468CZVE,10
+mcp_runtime_audit-0.1.0.dist-info/RECORD,,

mcp_runtime_audit-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

mcp_runtime_audit-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+mcp-audit = mcp_audit.cli:main

mcp_runtime_audit-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hao li
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mcp_runtime_audit-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+mcp_audit