MCP Security Audit

What qianniuspace/mcp-security-audit MCP server does

qianniuspace/mcp-security-audit MCP server exposes npm dependency auditing through the Model Context Protocol. It checks dependencies for known vulnerabilities and returns a structured result for each finding. The reported data can include the affected package, installed version, severity, vulnerability description, CVE identifier, GitHub advisory ID, CVSS score and vector, CWE identifiers, advisory URL, and whether a fix is available.

The server recognizes four severity levels: critical, high, moderate, and low. When a vulnerable dependency has a known remedy, the response can include a recommended version and the fixed version. A clean result is represented separately, with metadata and a message indicating that no known vulnerabilities were found.

How it works

Audits use integration with the remote npm registry, allowing the server to perform current checks against registry-provided security information rather than relying only on local example data. The output is transformed into a more structured format than the raw npm audit response. Each response includes metadata such as the audit timestamp and package manager.

The documented examples show results for npm packages, including a vulnerable lodash version and its related advisory information. The README also identifies npm, pnpm, and yarn as supported package managers. It does not document a separate database, authentication flow, or a user-configurable registry URL.

Setup and configuration

The package can be run directly through npx:

{
  "mcpServers": {
    "mcp-security-audit": {
      "command": "npx",
      "args": ["-y", "mcp-security-audit"]
    }
  }
}

The repository documents configuration for Cline and Cursor. Claude Desktop installation is also documented through Smithery. For a source-based setup, clone the repository, run npm install, and build it with npm run build; the resulting build entry point can then be referenced in an MCP client configuration.

Tools and capabilities

qianniuspace/mcp-security-audit MCP server provides dependency vulnerability scanning with:

• Real-time checks through a remote npm registry
• Critical, high, moderate, and low severity classification
• Structured vulnerability reports
• CVE, GitHub advisory, CVSS, and CWE details when available
• Upgrade recommendations and fixed-version information
• Support references for npm, pnpm, and yarn package managers
• Clean-result responses when no known vulnerabilities are found

The README describes the response format and capabilities but does not publish a named MCP tool or its complete input schema. Client configuration should therefore be based on the package instructions rather than an assumed tool name.

Limitations and notes

The server reports known vulnerabilities returned by its audit source; a clean response should not be interpreted as proof that dependencies are free of every possible security issue. Its operation depends on access to the remote npm registry. The supplied material does not describe offline operation, private registry configuration, lockfile-specific behavior, authentication options, or automatic modification of project files. Fix recommendations are reported as audit results; the documentation does not state that the server applies upgrades itself.

The project is released under the MIT License. Example response files are included in the repository for development reference, but they are transformed examples rather than a substitute for a live audit.