mcp-runtime-audit 0.1.0__tar.gz

mcp_runtime_audit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hao li
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mcp_runtime_audit-0.1.0/PKG-INFO

@@ -0,0 +1,173 @@
+Metadata-Version: 2.4
+Name: mcp-runtime-audit
+Version: 0.1.0
+Summary: Local runtime security scanner for MCP servers — known-CVE checks, one-click fixes
+Author-email: hao li <haoli5933@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/hahahahahahahahah6/mcp-audit
+Keywords: mcp,security,scanner,cli,cve
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# mcp-audit
+
+A local runtime security scanner for MCP servers. Point it at your MCP client
+configs and it flags the misconfigurations and known vulnerabilities that
+actually get exploited — then offers one-click fixes. Zero third-party
+dependencies, Python >= 3.9.
+
+```bash
+pip install mcp-runtime-audit
+mcp-audit scan
+```
+
+## Why this exists
+
+MCP servers run with your user's privileges and are driven by an AI agent on
+your behalf — which makes them a very different threat surface from a library
+you import. The evidence so far is not reassuring:
+
+- **The official tooling itself has shipped RCE.** CVE-2025-49596 hit
+  Anthropic's MCP Inspector (CVSS 9.4): its local proxy accepted an
+  unauthenticated `/sse` request with `transportType=stdio&command=<cmd>` and
+  spawned it as a subprocess — visiting a malicious page was enough to run
+  code on the developer's machine. Fixed in Inspector 0.14.1.
+- **Enterprise MCP apps are not immune.** CVE-2026-76404 (Splunk MCP Server
+  < 1.2.1, CVSS 9.1): unsafe deserialization in credential management let an
+  admin-role user execute arbitrary OS commands (Splunk advisory
+  SVD-2026-0808).
+- **Anthropic treats stdio risk as "expected"** — the position is that the
+  security burden sits with whoever deploys the server, not the protocol.
+  That leaves every local config file as the real security boundary, and
+  those files are hand-edited JSON.
+- **Unpatched servers are out there in production.** Five US federal
+  government MCP servers were found running unpatched, and internet-wide
+  scans keep turning up thousands of exposed MCP endpoints, the vast majority
+  without any authentication.
+
+Nobody audits their own `~/.claude.json` by hand. mcp-audit does it in a
+second, in CI-friendly form.
+
+## How it differs
+
+| Tool | Known-CVE version checks | One-click fixes | Focus |
+|------|--------------------------|-----------------|-------|
+| **mcp-audit** | ✅ bundled CVE table | ✅ `fix --apply` | runtime security |
+| mcpscan | ❌ | ❌ | static config scanning |
+| graygnatconsole mcp-audit-tool | ❌ | ❌ | config auditing |
+| mcp-lint | n/a | n/a | **design quality** linting, not runtime security — no overlap |
+
+mcpscan and graygnatconsole's mcp-audit-tool scan configs but neither maps
+your installed server versions against known CVEs, and neither writes fixes
+back. mcp-lint is a design-quality linter for MCP servers; mcp-audit is a
+runtime security scanner for the servers you run — different layer, no
+overlap.
+
+## Quick start
+
+```bash
+pip install mcp-runtime-audit
+
+# scan default locations (~/.claude.json, ~/.codex/config.json,
+# ~/.config/mcp/servers.json, ~/.mcp.json)
+mcp-audit scan
+
+# scan a specific file, JSON output for CI
+mcp-audit scan --config ~/my-claude.json --format json
+
+# confirm unauthenticated reachability with a live probe
+# (one unauthenticated GET per endpoint)
+mcp-audit scan --probe
+
+# preview fixes (dry run), then apply them (backs up first)
+mcp-audit fix --config ~/.claude.json
+mcp-audit fix --config ~/.claude.json --apply
+```
+
+Exit codes: `0` clean, `1` findings, `2` errors — CI-ready.
+
+## What it checks
+
+1. **Dangerous stdio commands (`STDIO-SHELL`, high).** A stdio entry wrapping
+   execution in `bash -c` / `sh -c` / `cmd /c` is command injection by
+   design — this is the Langflow CVE-2026-105697 pattern (CVSS 9.9). Flags
+   the server and shows the exact invocation.
+2. **Unauthenticated SSE/HTTP endpoints (`UNAUTH-ENDPOINT`,
+   critical with `--probe`).** Endpoints with no `Authorization`/`X-API-Key`
+   header. `--probe` sends one unauthenticated GET to confirm the endpoint
+   actually answers — the CVE-2025-49596 shape.
+3. **Bind addresses (`BIND-ADDR`, high).** Servers bound to `0.0.0.0` or `::`
+   in URLs, `--host` flags, or env vars are reachable beyond localhost.
+4. **Known-CVE version checks (`KNOWN-CVE`, per-CVE severity).** Extracts
+   `package@version` from `npx`/`uvx` invocations and matches against the
+   bundled CVE table below.
+
+Every finding carries a rule id, CVE id, severity, the evidence, and the fix
+command — in both text and JSON output.
+
+### One-click fix
+
+`mcp-audit fix` defaults to a dry-run plan. With `--apply` it:
+
+- rewrites `0.0.0.0` → `127.0.0.1` in URLs, `--host` flags, and env values,
+- adds an `Authorization: Bearer ${MCP_TOKEN}` placeholder header to
+  unauthenticated endpoints (you fill in a real token),
+- backs up the config to `<file>.bak-<timestamp>` before writing,
+- links critical servers into agent-guard's `blocked_servers` list when an
+  agent-guard config is detected (see below).
+
+### agent-guard integration
+
+`mcp-audit scan --link-agent-guard` writes every critical server into
+agent-guard's blocklist (config backed up first). If agent-guard isn't
+installed, it prints the manual linking instruction instead.
+
+## CVE table
+
+Bundled advisory snapshot (2026-10). Re-check NVD / vendor releases before
+using these for compliance reporting.
+
+| CVE | Product | Affected | Fix | Class |
+|-----|---------|----------|-----|-------|
+| CVE-2025-49596 | @modelcontextprotocol/inspector | < 0.14.1 | 0.14.1 | Unauthenticated RCE, CVSS 9.4 |
+| CVE-2026-76404 | splunk-mcp-server | < 1.2.1 | 1.2.1 | Unsafe deserialization RCE, CVSS 9.1 |
+| CVE-2026-58201 | lokka (M365 MCP) | < 2.1.2 | 2.1.2 | SSRF leaking ARM bearer token |
+| CVE-2026-105697 | langflow / langflow-base / lfx | < 1.10.3 | 1.10.3 | MCP stdio `bash -c` RCE, CVSS 9.9 |
+| CVE-2026-89039 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-105793 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-94486 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-19807 | (product mapping pending) | — | — | See NVD |
+
+## CI example
+
+```yaml
+# .github/workflows/mcp-audit.yml
+- uses: actions/setup-python@v5
+  with: { python-version: "3.12" }
+- run: pip install mcp-runtime-audit
+- run: mcp-audit scan --config ./mcp-servers.json --format json
+# exits 1 on findings -> fails the build
+```
+
+## Limitations
+
+- Version detection reads `package@version` from your config's command/args
+  (npx/uvx/node style). Servers installed another way, or without a pinned
+  version, won't match the CVE table.
+- `--probe` sends one unauthenticated GET per endpoint — no auth bypass
+  attempts, no payloads, and it never mutates anything. It still touches
+  the network; don't run it against hosts you don't own.
+- The CVE table is a bundled snapshot, not a live feed. New CVEs need a new
+  release.
+- Static checks can't see what a server does after it starts (dynamic tool
+  behavior, prompt injection in tool outputs). This is a config/runtime
+  surface scanner, not a runtime behavior monitor.
+
+## License
+
+MIT.

mcp_runtime_audit-0.1.0/README.md

@@ -0,0 +1,157 @@
+# mcp-audit
+
+A local runtime security scanner for MCP servers. Point it at your MCP client
+configs and it flags the misconfigurations and known vulnerabilities that
+actually get exploited — then offers one-click fixes. Zero third-party
+dependencies, Python >= 3.9.
+
+```bash
+pip install mcp-runtime-audit
+mcp-audit scan
+```
+
+## Why this exists
+
+MCP servers run with your user's privileges and are driven by an AI agent on
+your behalf — which makes them a very different threat surface from a library
+you import. The evidence so far is not reassuring:
+
+- **The official tooling itself has shipped RCE.** CVE-2025-49596 hit
+  Anthropic's MCP Inspector (CVSS 9.4): its local proxy accepted an
+  unauthenticated `/sse` request with `transportType=stdio&command=<cmd>` and
+  spawned it as a subprocess — visiting a malicious page was enough to run
+  code on the developer's machine. Fixed in Inspector 0.14.1.
+- **Enterprise MCP apps are not immune.** CVE-2026-76404 (Splunk MCP Server
+  < 1.2.1, CVSS 9.1): unsafe deserialization in credential management let an
+  admin-role user execute arbitrary OS commands (Splunk advisory
+  SVD-2026-0808).
+- **Anthropic treats stdio risk as "expected"** — the position is that the
+  security burden sits with whoever deploys the server, not the protocol.
+  That leaves every local config file as the real security boundary, and
+  those files are hand-edited JSON.
+- **Unpatched servers are out there in production.** Five US federal
+  government MCP servers were found running unpatched, and internet-wide
+  scans keep turning up thousands of exposed MCP endpoints, the vast majority
+  without any authentication.
+
+Nobody audits their own `~/.claude.json` by hand. mcp-audit does it in a
+second, in CI-friendly form.
+
+## How it differs
+
+| Tool | Known-CVE version checks | One-click fixes | Focus |
+|------|--------------------------|-----------------|-------|
+| **mcp-audit** | ✅ bundled CVE table | ✅ `fix --apply` | runtime security |
+| mcpscan | ❌ | ❌ | static config scanning |
+| graygnatconsole mcp-audit-tool | ❌ | ❌ | config auditing |
+| mcp-lint | n/a | n/a | **design quality** linting, not runtime security — no overlap |
+
+mcpscan and graygnatconsole's mcp-audit-tool scan configs but neither maps
+your installed server versions against known CVEs, and neither writes fixes
+back. mcp-lint is a design-quality linter for MCP servers; mcp-audit is a
+runtime security scanner for the servers you run — different layer, no
+overlap.
+
+## Quick start
+
+```bash
+pip install mcp-runtime-audit
+
+# scan default locations (~/.claude.json, ~/.codex/config.json,
+# ~/.config/mcp/servers.json, ~/.mcp.json)
+mcp-audit scan
+
+# scan a specific file, JSON output for CI
+mcp-audit scan --config ~/my-claude.json --format json
+
+# confirm unauthenticated reachability with a live probe
+# (one unauthenticated GET per endpoint)
+mcp-audit scan --probe
+
+# preview fixes (dry run), then apply them (backs up first)
+mcp-audit fix --config ~/.claude.json
+mcp-audit fix --config ~/.claude.json --apply
+```
+
+Exit codes: `0` clean, `1` findings, `2` errors — CI-ready.
+
+## What it checks
+
+1. **Dangerous stdio commands (`STDIO-SHELL`, high).** A stdio entry wrapping
+   execution in `bash -c` / `sh -c` / `cmd /c` is command injection by
+   design — this is the Langflow CVE-2026-105697 pattern (CVSS 9.9). Flags
+   the server and shows the exact invocation.
+2. **Unauthenticated SSE/HTTP endpoints (`UNAUTH-ENDPOINT`,
+   critical with `--probe`).** Endpoints with no `Authorization`/`X-API-Key`
+   header. `--probe` sends one unauthenticated GET to confirm the endpoint
+   actually answers — the CVE-2025-49596 shape.
+3. **Bind addresses (`BIND-ADDR`, high).** Servers bound to `0.0.0.0` or `::`
+   in URLs, `--host` flags, or env vars are reachable beyond localhost.
+4. **Known-CVE version checks (`KNOWN-CVE`, per-CVE severity).** Extracts
+   `package@version` from `npx`/`uvx` invocations and matches against the
+   bundled CVE table below.
+
+Every finding carries a rule id, CVE id, severity, the evidence, and the fix
+command — in both text and JSON output.
+
+### One-click fix
+
+`mcp-audit fix` defaults to a dry-run plan. With `--apply` it:
+
+- rewrites `0.0.0.0` → `127.0.0.1` in URLs, `--host` flags, and env values,
+- adds an `Authorization: Bearer ${MCP_TOKEN}` placeholder header to
+  unauthenticated endpoints (you fill in a real token),
+- backs up the config to `<file>.bak-<timestamp>` before writing,
+- links critical servers into agent-guard's `blocked_servers` list when an
+  agent-guard config is detected (see below).
+
+### agent-guard integration
+
+`mcp-audit scan --link-agent-guard` writes every critical server into
+agent-guard's blocklist (config backed up first). If agent-guard isn't
+installed, it prints the manual linking instruction instead.
+
+## CVE table
+
+Bundled advisory snapshot (2026-10). Re-check NVD / vendor releases before
+using these for compliance reporting.
+
+| CVE | Product | Affected | Fix | Class |
+|-----|---------|----------|-----|-------|
+| CVE-2025-49596 | @modelcontextprotocol/inspector | < 0.14.1 | 0.14.1 | Unauthenticated RCE, CVSS 9.4 |
+| CVE-2026-76404 | splunk-mcp-server | < 1.2.1 | 1.2.1 | Unsafe deserialization RCE, CVSS 9.1 |
+| CVE-2026-58201 | lokka (M365 MCP) | < 2.1.2 | 2.1.2 | SSRF leaking ARM bearer token |
+| CVE-2026-105697 | langflow / langflow-base / lfx | < 1.10.3 | 1.10.3 | MCP stdio `bash -c` RCE, CVSS 9.9 |
+| CVE-2026-89039 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-105793 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-94486 | (product mapping pending) | — | — | See NVD |
+| CVE-2026-19807 | (product mapping pending) | — | — | See NVD |
+
+## CI example
+
+```yaml
+# .github/workflows/mcp-audit.yml
+- uses: actions/setup-python@v5
+  with: { python-version: "3.12" }
+- run: pip install mcp-runtime-audit
+- run: mcp-audit scan --config ./mcp-servers.json --format json
+# exits 1 on findings -> fails the build
+```
+
+## Limitations
+
+- Version detection reads `package@version` from your config's command/args
+  (npx/uvx/node style). Servers installed another way, or without a pinned
+  version, won't match the CVE table.
+- `--probe` sends one unauthenticated GET per endpoint — no auth bypass
+  attempts, no payloads, and it never mutates anything. It still touches
+  the network; don't run it against hosts you don't own.
+- The CVE table is a bundled snapshot, not a live feed. New CVEs need a new
+  release.
+- Static checks can't see what a server does after it starts (dynamic tool
+  behavior, prompt injection in tool outputs). This is a config/runtime
+  surface scanner, not a runtime behavior monitor.
+
+## License
+
+MIT.

mcp_runtime_audit-0.1.0/pyproject.toml

@@ -0,0 +1,28 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "mcp-runtime-audit"
+version = "0.1.0"
+description = "Local runtime security scanner for MCP servers — known-CVE checks, one-click fixes"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "hao li", email = "haoli5933@gmail.com" }]
+keywords = ["mcp", "security", "scanner", "cli", "cve"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: MIT License",
+    "Topic :: Security",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/hahahahahahahahah6/mcp-audit"
+
+[project.scripts]
+mcp-audit = "mcp_audit.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

mcp_runtime_audit-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

mcp_runtime_audit-0.1.0/src/mcp_audit/__init__.py

@@ -0,0 +1,4 @@
+"""mcp-audit: local runtime security scanner for MCP servers."""
+
+__version__ = "0.1.0"
+__all__ = ["__version__"]

mcp_runtime_audit-0.1.0/src/mcp_audit/cli.py

@@ -0,0 +1,173 @@
+"""mcp-audit CLI: scan local MCP configs and optionally fix them."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from . import __version__
+from .scanners import (
+    agent_guard_link,
+    apply_fixes,
+    discover_configs,
+    load_config,
+    plan_fixes,
+    run_all_scans,
+)
+
+EXIT_OK = 0
+EXIT_FINDINGS = 1
+EXIT_ERROR = 2
+
+
+def _parse_args(argv):
+    parser = argparse.ArgumentParser(
+        prog="mcp-audit",
+        description="Local runtime security scanner for MCP servers.",
+    )
+    parser.add_argument("--version", action="version", version=__version__)
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan = sub.add_parser("scan", help="scan MCP configs for security issues")
+    scan.add_argument("--config", action="append", dest="configs",
+                      metavar="PATH", default=[],
+                      help="config file to scan (repeatable; defaults to "
+                           "~/.claude.json and other known locations)")
+    scan.add_argument("--format", choices=["text", "json"], default="text",
+                      help="output format")
+    scan.add_argument("--probe", action="store_true",
+                      help="send one unauthenticated GET to each http/sse "
+                           "endpoint to confirm reachability")
+    scan.add_argument("--timeout", type=float, default=4.0,
+                      help="probe timeout in seconds (default 4.0)")
+    scan.add_argument("--link-agent-guard", action="store_true",
+                      help="write critical servers into agent-guard's "
+                           "blocklist when it is installed")
+
+    fix = sub.add_parser("fix", help="print or apply one-click fixes")
+    fix.add_argument("--config", action="append", dest="configs",
+                     metavar="PATH", default=[],
+                     help="config file to fix (repeatable)")
+    fix.add_argument("--apply", action="store_true",
+                     help="write the fixes to the config file (backs up "
+                          "first); without it only prints the plan")
+    return parser.parse_args(argv)
+
+
+def _load_all(paths):
+    servers, errors = [], []
+    for path in paths:
+        svcs, err = load_config(path)
+        if err:
+            errors.append(err)
+        servers.extend(svcs)
+    return servers, errors
+
+
+def _format_text(findings, errors, n_servers, n_configs):
+    lines = []
+    if errors:
+        for e in errors:
+            lines.append("error: %s" % e)
+    if not findings:
+        lines.append("mcp-audit: %d server(s) in %d config(s): no findings"
+                     % (n_servers, n_configs))
+        return "\n".join(lines)
+    sev_max = findings[0].severity
+    lines.append("mcp-audit: %d finding(s) across %d server(s) "
+                 "(worst: %s):" % (len(findings), n_servers, sev_max))
+    for f in findings:
+        cve = " [%s]" % f.cve_id if f.cve_id else ""
+        lines.append("[%s]%s %s (%s): %s"
+                     % (f.severity.upper(), cve, f.rule_id, f.server, f.evidence))
+        lines.append("  fix: %s" % f.fix)
+    return "\n".join(lines)
+
+
+def cmd_scan(args):
+    paths = discover_configs(args.configs)
+    if not paths:
+        msg = {"findings": [], "errors": ["no config files found"],
+               "summary": {"servers": 0, "configs": 0}}
+        if args.format == "json":
+            print(json.dumps(msg, indent=2))
+        else:
+            print("mcp-audit: no MCP config files found "
+                  "(checked ~/.claude.json, ~/.codex/config.json, "
+                  "~/.config/mcp/servers.json, ~/.mcp.json); "
+                  "pass --config PATH to scan a specific file")
+        return EXIT_ERROR
+    servers, errors = _load_all(paths)
+    findings = run_all_scans(servers, probe=args.probe, timeout=args.timeout)
+    if args.link_agent_guard and findings:
+        linked, msg = agent_guard_link(findings)
+        if args.format == "json":
+            pass  # message folded into output below
+        else:
+            print(msg)
+    if args.format == "json":
+        print(json.dumps({
+            "findings": [f.to_dict() for f in findings],
+            "errors": errors,
+            "summary": {
+                "servers": len(servers),
+                "configs": len(paths),
+                "findings": len(findings),
+                "worst": findings[0].severity if findings else None,
+            },
+        }, indent=2))
+    else:
+        print(_format_text(findings, errors, len(servers), len(paths)))
+    if errors and not servers:
+        return EXIT_ERROR
+    return EXIT_FINDINGS if findings else EXIT_OK
+
+
+def cmd_fix(args):
+    paths = discover_configs(args.configs)
+    if not paths:
+        print("mcp-audit: no MCP config files found; pass --config PATH")
+        return EXIT_ERROR
+    rc = EXIT_OK
+    for path in paths:
+        servers, errors = _load_all([path])
+        findings = run_all_scans(servers)
+        plan, missing = plan_fixes(path, findings) if not errors else ([], [])
+        if args.apply:
+            if errors:
+                print("%s: error: %s" % (path, errors[0]))
+                rc = EXIT_ERROR
+                continue
+            if not plan:
+                print("%s: nothing fixable" % path)
+                continue
+            backup, applied = apply_fixes(path, findings)
+            print("%s: applied %d fix(es); backup at %s"
+                  % (path, applied, backup))
+        else:
+            print("%s:" % path)
+            if not plan and not missing:
+                print("  nothing fixable")
+            for item in plan:
+                print("  - [%s] %s: %s" % (
+                    item["rule_id"], item["server"], item["action"]))
+            for name in missing:
+                print("  - %s: server not found in config (skipped)" % name)
+            if plan:
+                print("  re-run with --apply to write these fixes "
+                      "(config is backed up first)")
+    return rc
+
+
+def main(argv=None):
+    args = _parse_args(argv if argv is not None else sys.argv[1:])
+    if args.command == "scan":
+        return cmd_scan(args)
+    if args.command == "fix":
+        return cmd_fix(args)
+    return EXIT_ERROR
+
+
+if __name__ == "__main__":
+    sys.exit(main())