mcpAuditorium

Open-source security auditor for MCP servers. Catches tool poisoning, data leaks and silent changes 100% on your machine, for free, with nothing ever leaving your computer. Privacy by design.

Comment

mcpAuditorium

Offline, deterministic security auditor for Model Context Protocol (MCP) servers.

mcpAuditorium (CLI: mcpa) scans your MCP servers for tool poisoning, prompt injection, data-exfiltration intent, sensitive-path references, over-privileged tools and silent tool mutations — entirely on your machine. No tool descriptions or configs ever leave your computer, it costs nothing to run, and connecting an AI model is optional, never required.

Status: early development (v0.1). See the Roadmap.

Inspiration

MCP servers make AI assistants far more useful by connecting them to files, databases, APIs, and developer tools. But that same convenience creates a growing security blind spot: a server can hide malicious instructions in tool descriptions, reference sensitive files, exfiltrate data, or silently change after it has been approved. mcpAuditorium was built to make that risk visible before an assistant relies on a server. It is a local, deterministic security auditor for MCP servers: no cloud upload, no mandatory AI model, and no tool execution during inspection. We wanted a practical way to help developers adopt the MCP ecosystem with more confidence.

Why

MCP servers run as local processes your AI client trusts. A malicious or poorly built server can hide instructions inside a tool's metadata that trick the model into leaking secrets — and you never see it. Most tools that check for this run in the cloud and send your metadata to a third party. mcpAuditorium does the opposite: it audits locally, deterministically, and free.

Challenges faced

The main challenge was balancing useful inspection with a strict security posture. Even reading MCP metadata can require launching an untrusted stdio server, so the project separates safe configuration discovery from opt-in metadata inspection, uses timeouts, and never invokes tools. We also needed detection rules that are explainable and reliable rather than vague AI judgments. We designed a YAML-based static rule engine with deterministic regex rules, embedded rule packs, reproducible findings, and tests for both malicious and benign cases to reduce false positives. Finally, supporting multiple clients required handling different local configuration formats—JSON for Claude and Cursor, TOML for Codex CLI—while keeping discovery offline and resilient to malformed files.

Coding with help of agents makes it

Features

  • Static analysis (no execution): reads server metadata (tools/list, resources/list, prompts/list) without invoking any tool and applies security rules over descriptions and JSON Schemas.
  • Rug-pull detection: a local lockfile (mcpauditorium.lock) hashes each approved tool; mcpa verify flags any silent change to a previously approved tool.
  • Multi-client discovery: finds MCP server configs across clients (Claude Desktop, Cursor, Codex CLI; more coming).
  • CI-friendly output: terminal, JSON and SARIF 2.1.0 (for GitHub code scanning). Non-zero exit code on critical findings.
  • 100% offline & deterministic by default. Optional AI layer can run a local model (Ollama) — never mandatory.

Install

go install github.com/adriihdezz/mcpAuditorium/cmd/mcpa@latest

Or download a single binary from the releases page. Requires Go 1.23+ to build from source.

Usage

# Audit every MCP server discovered across your clients
mcpa scan

# Output formats for CI
mcpa scan --format=sarif > results.sarif
mcpa scan --format=json

# Rug-pull protection: approve current state, then verify later
mcpa lock            # writes mcpauditorium.lock
mcpa verify          # fails if an approved tool's description/schema changed

How it works

Three layers, with a deterministic core and an optional AI layer:

  1. Static (default, deterministic): connects, fetches metadata without calling tools, runs the rule engine. Zero outbound network, zero tokens.
  2. Fuzzer (opt-in, sandboxed): generates inputs from each tool's JSON Schema and watches for crashes, auth bypass, resource exhaustion and reflected injection.
  3. Semantic AI (opt-in, never default): catches subtle prompt injection using a local model (Ollama/llama.cpp) or an API you connect yourself.

Security by design: introspecting a stdio server means starting its process, so mcpAuditorium parses configs without launching anything, and any process it does start for metadata runs in a sandbox (isolated subprocess, no network by default, restricted filesystem, timeouts and resource limits).

Rules

Rules are defined in versioned YAML packs and map to OWASP MCP Top 10 / CWE categories. The v0.1 static set covers hidden instructions (TP-001), invisible unicode (TP-002), data-exfiltration intent (EX-001), sensitive-path references (SP-001), tool shadowing (SH-001) and rug-pull detection (RP-001). The full rule catalog will ship with the rule engine (Stage 3).

Privacy

Nothing leaves your machine. No telemetry, no outbound network in the core (only localhost when an MCP transport requires it), no AI calls unless you explicitly enable the optional semantic layer.

Roadmap

  • v0.1 — Static auditor: discovery + static rules + rug-pull lockfile + terminal/SARIF output.
  • v0.2 — Sandboxed fuzzer + remaining static rules.
  • v0.3 — Optional semantic AI layer (local model).
  • v0.4+ — Community rule packs, GitHub Action, official registry integration.

Contributing

Rule packs live in rules/*.yaml and can be added without recompiling the binary. Contributions of new detection rules (with a positive and a negative test fixture) are welcome.

License

Apache-2.0.

Built With

  • ai-security
  • cli
  • cybersecurity
  • developer-tools
  • go
  • mcp
  • offline-first
  • open-source
  • prompt-injection
  • rug-pull
  • sdk
  • security
  • server
  • supply-chain
  • tool-poisoning
Share this project:

Updates