| name | defensive-mcp-audit |
| description | Runs a defensive, read-only security audit of the local machine for MCP and AIagent risks: risky bindings, MCP config issues, and confused-deputy exposu re.Use before enabling MCP servers or when the user says audit mcp, check lo calhost exposure, mcp security. Outputs text, JSON, SARIF, or HTML. Triggers : audit mcp, mcp security, defensive-mcp-audit. Use when the user needs this
capability.
|
| version | 1.0.0 |
| author | Stijnman |
| license | MIT |
| metadata | {"grok":{"tags":["audit mcp","mcp security","localhost exposure","defensive-mcp-audit"],"related_skills":["exposed-service-triage","mcp-tool-scout","hitl-approver"],"publication_reviewed":"2026-06-24"}} |
| compatibility | Grok agent; optional MCP and shell access |
Defensive Mcp Audit
When to Use
- User says audit mcp or task matches this capability
- User says mcp security or task matches this capability
- User says localhost exposure or task matches this capability
- User says defensive-mcp-audit or task matches this capability
Workflow
- Confirm audit is read-only; no port scanning beyond localhost inventory.
- Run: python3 -m defensive_mcp_audit (or pip install defensive-mcp-audit[cli]).
- Parse risk_level, risk_score, and findings table.
- Explain each finding in plain language with remediation (bind localhost, disable service).
- Never suggest attack techniques, malware, or penetration tests.
- Offer HTML/JSON export path; do not upload reports externally without user consent.
Integrations
exposed-service-triagemcp-tool-scouthitl-approver
Error Handling
| Failure | Response |
|---|
| Tool not installed | pip install defensive-mcp-audit[cli] or clone github.com/Stijnman/defensive-mcp-audit. |
| Permission denied on ss | Report limitation; suggest user-run with adequate permissions. |
Gotchas
- Defensive only — inspection, not exploitation.
Safety & Ethics (Publication-Ready)
This skill is designed for public distribution. Constraints:
- Read-only inspection; no network attacks or exploitation.
- Reports stay local unless user explicitly requests upload.
- Remediation advice is configuration-only (bind, disable, firewall).
Prohibited actions
- No unauthorized access, malware, or harmful automation
- No silent exfiltration of data, credentials, or telemetry
- No destructive system changes without hitl-approver
- No publication of user PII or environment secrets in outputs
Attribution
- Wraps the MIT-licensed defensive-mcp-audit project by Stijnman.
Example
Input: User request matching triggers above.
Output: Structured result per workflow; local artifacts only unless user opts in.
