| name | defensive-mcp-audit |
| description | Run a defensive, read-only security audit of the local machine for MCP and AI agent risks: risky network bindings (0.0.0.0), MCP server configuration issues, confused-deputy exposure, and installed agent framework inventory. Outputs text, JSON, SARIF, or HTML reports.
|
| metadata | {"short-description":"Defensive MCP/agent localhost security audit","argument-hint":"[--format json|sarif|html] [--output path]","when-to-use":"\"audit mcp\", \"check localhost exposure\", \"mcp security\", \"confused deputy\", \"scan listening ports\", \"defensive-mcp-audit\", before enabling new MCP servers\n"} |
defensive-mcp-audit
Defensive-only audit for local MCP and AI agent environments. Read-only. No exploitation.
When to use
- Before enabling a new MCP server or agent gateway
- After installing Hermes, Claude Desktop MCP, Cursor MCP, or Grok MCP integrations
- In CI weekly jobs on developer machines
- When investigating DNS rebinding / localhost trust-boundary concerns
Quick commands
python3 -m defensive_mcp_audit
pip install defensive-mcp-audit[cli]
defensive-mcp-audit --format html -o audit-report.html
defensive-mcp-audit --format sarif -o results.sarif
defensive-mcp-audit --format json -o report.json
Python API
from defensive_mcp_audit import audit_mcp_environment, generate_sarif, generate_html_report
report = audit_mcp_environment()
print(report["risk_level"], report["risk_score"])
What it checks
- Listening TCP services (
ss on Linux, netstat fallback)
- MCP-related vs system vs unknown process classification
- Weighted risk scoring (Samba ≠ MCP server)
- Static MCP config discovery (Claude, Cursor, VS Code, Grok,
.mcp.json)
- Installed AI framework package inventory
- Optional plugin checks in
checks/ (see checks/example_port_check.py)
Interpreting results
| Finding ID | Meaning |
|---|
MCP_EXPOSED_NON_LOCALHOST | MCP-related service on 0.0.0.0 — fix immediately |
SYSTEM_EXPOSED_LISTENER | OS service (e.g. Samba) — informational |
MCP_CONFIG_RISK | Risky patterns in MCP client config |
CONFUSED_DEPUTY_RISK | Local MCP surface reachable by agents/browsers |
Ethics
Strictly defensive. Never generate exploits, payloads, or offensive guidance.
