MCP Audit

What mcp-audit MCP server does

The mcp-audit MCP server places a transparent proxy between an MCP client and an upstream server. It supports two connection patterns: run -- wraps a local command that communicates over stdio, while serve forwards requests to a remote Streamable HTTP endpoint. Authentication is passed through rather than managed by the proxy, including authorization headers, OAuth flows, and Mcp-Session-Id values.

The proxy records MCP messages to a local JSONL file. Events can include the server name, direction, method, tool name, arguments, results, timestamps, and policy flags. Developers can inspect this file with standard command-line tools such as jq to review which tools were called and what arguments were supplied.

How it works

On first observation, the mcp-audit MCP server stores each tool description and schema as a baseline. If a later session changes either one, it raises an alarm until the change is inspected with mcp-audit lock diff and approved with mcp-audit lock approve. This provides a review step for changes that could represent a tool “rug pull.”

The proxy also scans advertised tool descriptions and schema fields for heuristic indicators such as instruction overrides, concealed instructions, credential-related bait, exfiltration language, cross-tool commands, and invisible characters. Tool results receive a narrower scan for instruction overrides, hidden instructions, and concealment. Results may be text, embedded resources, resource links, structured content, or JSON-RPC errors.

Detection normally flags events without blocking them. Policy rules can be configured to allow or deny selected activity, and the default shadow mode records activity without blocking calls. The project reports zero false positives in its included benign corpus, but notes that the corpus is limited and does not measure attack detection rates.

Setup and configuration

For a local server, place mcp-audit run -- before the command already used by the MCP client:

mcp-audit run -- npx -y @modelcontextprotocol/server-filesystem /tmp

For a remote server, start the HTTP proxy and point the client at its listening address:

mcp-audit serve --target https://example.com/mcp --listen :9000

The default audit log is ~/.mcp-audit/logs/events.jsonl. No configuration file is required for the basic setup. The repository provides client configuration examples for Claude Desktop, Cursor, and Windsurf.

The npm package and release binaries described in the README are version 0.1.0 and predate mcp-audit lock and result scanning. To use those features before the stated 0.2.0 release, build from source with Go 1.24 or newer, or install the current Go package.

Tools and capabilities

The mcp-audit MCP server provides these operational capabilities:

• Wrap local stdio MCP processes.
• Proxy remote Streamable HTTP MCP servers.
• Record requests, responses, tool calls, arguments, and results as JSONL.
• Detect suspicious patterns in tool descriptions, schemas, and results.
• Compare and approve changed tool locks through the lock diff and lock approve commands.
• Apply optional allow/deny policy rules.

All processing runs locally unless a webhook is configured. The project is licensed under Apache-2.0.

Limitations and notes

The detectors are heuristics, so an alert is an item for review rather than proof of an attack. The published benign-result measurement comes from one MCP server, and the project does not provide attack detection-rate figures. The proxy records by default, while blocking requires explicit policy configuration.