Model Context Protocol Security

Audit an MCP server config
before you connect it

A free, open-source scanner catches leaked credentials, SSRF exposure, missing authentication and over-privileged commands in your mcpServers config — before a single tool call runs. Need deeper assurance? Get a manual audit with a signed, independently verifiable report.

Run the free scanner See professional audits
14Automated checks
0Network calls
MITOpen-source license
SARIFCI-ready output
01 / Free & Open Source

mcp-server-audit — a 30-second config scan

Point it at your MCP configuration file. It performs 14 static checks entirely on your machine, prints CRIT/HIGH/MED/LOW findings with concrete fixes, and exits non-zero on critical issues so it can gate CI. It never connects to any URL in the config and sends no data anywhere.

bash
# scan an MCP config (npx, no install required) $ npx mcp-server-audit mcp.json [CRIT] hardcoded-cloud-secret env.ANTHROPIC_API_KEY matches a cloud key pattern [HIGH] arbitrary-command-exec command runs a shell with interpolated args [HIGH] ssrf-egress-missing no egress allowlist; remote MCP can reach internal hosts [MED] plaintext-http-endpoint url uses http:// instead of https:// [MED] unpinned-remote-package npx/uvx launcher without an exact version pin # machine-readable output for CI / dashboards $ npx mcp-server-audit mcp.json --format sarif -o report.sarif # exit code 1 = critical findings (fails the pipeline); 0 = clean
5 CRITICAL GATES

Fail-closed checks

TLS enforcement, authentication requirement, credential exposure, SSRF protection and version pinning.

9 ADVISORIES

Hygiene & hardening

Writable mounts, over-broad tool clustering, plaintext transport and other risky defaults.

ZERO NETWORK

Air-gap safe

Pure static analysis. The tool never dials endpoints found in the configuration.

CI NATIVE

SARIF + JSON + exit codes

SARIF 2.1.0 for GitHub code scanning, JSON for automation, non-zero exit on criticals.

npm package ↗  ·  Source on GitHub ↗

02 / Why It Matters

MCP configs are a new, trusted attack surface

Agents inherit the permissions of every MCP server they mount. A single malicious or misconfigured server can exfiltrate credentials, pivot to internal services, or execute commands — often from a config file copied without review.

03 / Service Tiers

Start free. Pay only when you need human assurance.

The automated scanner is and stays free under MIT. When you ship to production, answer to customers, or need evidence for a security review, the manual tiers add expert analysis and cryptographic proof.

Free CLI

$0
Forever · MIT license
  • 14 automated static checks
  • CRIT/HIGH/MED/LOW findings with fixes
  • SARIF 2.1.0 & JSON output
  • Non-zero exit gates CI
  • 100% local, zero network calls
  • Manual 116-check methodology
  • Signed conformance receipt
npx mcp-server-audit
Most chosen

Standard Manual Audit

$2,499
Fixed price · one MCP server or agent component · ~5 business days
  • Full 116-check manual audit methodology
  • Exploitability verification per finding
  • Technical report + executive summary (PDF)
  • Machine-readable JSON for Jira/Linear
  • Ed25519-signed conformance receipt
  • Prioritized remediation guidance
  • 30-day async re-verification of fixes
Request the audit

Enterprise & Custom

Custom
Scoped quote · full agent stack & ongoing assurance
  • Full stack: MCP servers + framework + deployment
  • Supply-chain & dependency mapping
  • Docker / Kubernetes / cloud config review
  • Continuous monitoring & intelligence
  • Custom conformance vectors & integration
  • Dedicated async support channel
  • NDA & custom engagement terms
Talk to us

Prices are listed exclusive of applicable taxes. Payments are processed by our Merchant of Record, which handles VAT/GST/sales tax globally; the final charged amount including any tax is shown before payment. All communication is asynchronous over email — we do not require calls for the Standard tier.

04 / How It Works

Three steps, about five days

No production access is required. A manual audit can run against a staging endpoint, a repository, or an exported trace bundle.

1
Submit
Send a repository, staging endpoint or config/trace export by email. We confirm scope and coverage within 24 hours.
2
Audit
We run the 14 automated checks plus the 116-rule manual methodology, verifying exploitability rather than guessing.
3
Report
You receive the full report, prioritized fixes and an Ed25519-signed receipt anyone can verify offline.
05 / FAQ

Common questions

What is the difference between the free CLI and the paid audit?
The CLI runs 14 automated static checks on a configuration file — fast, local, repeatable, and great for pre-commit and CI gating. The paid Standard audit applies a 116-check manual methodology performed by a security engineer across runtime behavior and source, verifies whether each finding is actually exploitable, and produces an Ed25519-signed conformance receipt. Automated scanning never claims coverage it does not have.
Does the scanner send my config anywhere?
No. It is pure static analysis with zero network calls; it never connects to any host named in the configuration. You can run it fully offline or air-gapped, and audit the MIT-licensed source yourself.
Do you need production access?
No. Manual audits work against a staging environment, a code repository, or exported trace logs. You never have to grant production credentials.
How do I verify a signed receipt?
Each receipt is machine-readable and Ed25519-signed over RFC 8785 canonicalized content. Using the published issuer public key, any third party can re-compute the content hash and verify signature and fields offline, with zero dependency on Correctover code or servers.
Which frameworks and MCP servers are supported?
The scanner works on standard mcpServers configuration regardless of client. Manual audits are framework-agnostic across Pydantic AI, CrewAI, AutoGen, LangChain, the OpenAI Agents SDK and custom stacks — the methodology targets runtime behavior and configuration rather than framework internals.
How is "CCS" related to an official standard like MCP?
CCS (Correctover Conformance Shape) is Correctover's own 7-dimension runtime verification model, documented in an individual Internet-Draft. It is not an RFC and is not endorsed by the IETF or by the Model Context Protocol organization. We state this plainly rather than implying external certification.
How do payments and taxes work?
Paid audits are billed through our Merchant of Record, which collects and remits VAT/GST/sales tax in 190+ countries and supports international cards and local payment methods. The price above excludes tax; the tax-inclusive total is always shown before you pay. Support: wangguigui@correctover.com.

Scan now. Pay only when you need proof.

Run the free CLI in under a minute, or email us to scope a manual audit.

Run free scan wangguigui@correctover.com