mcp-audit

mcp-audit — A Go tool for auditing Model Context Protocol (MCP) servers.

Features

• 🔍 Probe — runs the target MCP server and inspects supported features via JSON-RPC (tools, resources, prompts, sampling, transports).
• 📝 Scan — statically analyzes TypeScript source code (AST) to detect declared MCP APIs and transport usage.

CLI flags

-cwd is the local path of the project.
-github — GitHub is the URL for auto-cloning.
-args — additional arguments for the server.
-timeout — request timeout.
-startup-delay — delay before initialize.
-env — passing environment variables.
-ProtocolVersion is the version of the MCP protocol.
-out is the report format.

example

  go run ./cmd/mcp-probe \
  -github "https://github.com/upstash/context7" \
  -out json \
  -timeout 90s -startup-delay 2s 

output format

{
  "MCP Protocol Support": {
    "HTTP Transport": true,
    "Logging": false,
    "OAuth2 Auth": false,
    "Prompts": false,
    "Resources": false,
    "Roots": false,
    "SSE Transport": false,
    "STDIO Transport": true,
    "Sampling": false,
    "Tools": false
  }
}