skill
defensive-mcp-audit
Defensive security audit tool for AI Agent and MCP (Model Context Protocol) environments. Detects risky localhost exposure, weak bindings, and confused-deputy risks. Lightweight, SARIF + HTML reports,
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/Stijnman/defensive-mcp-audit itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
README
synced Oct 21, 2026Why this exists
MCP security research (2025–2026) showed that local MCP servers are often accidentally exposed via 0.0.0.0 bindings or reachable through DNS rebinding — enabling confused-deputy and drive-by attacks on developer machines.
This tool gives you a fast, actionable, defensive-only audit of those risks on your own machine.
Features
| Capability | Description |
|---|---|
| Listener discovery | ss on Linux, netstat fallback elsewhere |
| Smart classification | MCP-related vs system vs unknown processes |
| Weighted scoring | Samba ≠ MCP — fewer false CRITICAL alerts |
| MCP config scan | Claude, Cursor, VS Code, Grok, .mcp.json |
| Docker inspection | Read-only docker ps port publish analysis |
| Output formats | Terminal, JSON, SARIF, self-contained HTML |
| CI-ready | GitHub Action + weekly SARIF workflow included |
| Extensible | Plugin checks in checks/ |
Quick start
git clone https://github.com/Stijnman/defensive-mcp-audit.git
cd defensive-mcp-audit
pip install -e ".[cli]"
python -m defensive_mcp_audit
python -m defensive_mcp_audit --format html -o audit-report.html
python -m defensive_mcp_audit --format sarif -o results.sarif
Example output
Risk: HIGH (65)
Findings:
[medium] UNKNOWN_EXPOSED_LISTENER — Unclassified 0.0.0.0 bindings
[info] MCP_LOCALHOST_OK — Ollama on 127.0.0.1:11434
[info] SYSTEM_EXPOSED_LISTENER — smbd on 0.0.0.0:445 (informational)
Install
pip install defensive-mcp-audit[cli]
# Or from GitHub
pip install "git+https://github.com/Stijnman/defensive-mcp-audit@v0.3.2#egg=defensive-mcp-audit[cli]"
Python API
from defensive_mcp_audit import audit_mcp_environment, generate_sarif, generate_html_report
report = audit_mcp_environment()
print(report["risk_level"], report["risk_score"])
GitHub Action (one-click CI)
Add to any workflow:
- uses: Stijnman/defensive-mcp-audit/action@v0.3.2
with:
upload-sarif: "true"
Or run the full workflow — see .github/workflows/defensive-mcp-audit.yml.
Finding reference
| ID | Severity | Meaning |
|---|---|---|
MCP_EXPOSED_NON_LOCALHOST | high | MCP-related service on 0.0.0.0 — fix immediately |
UNKNOWN_EXPOSED_LISTENER | medium | Unclassified 0.0.0.0 listener — review |
SYSTEM_EXPOSED_LISTENER | info | OS service (e.g. Samba) — noted, low MCP impact |
MCP_CONFIG_RISK | medium | Risky patterns in MCP client config |
CONFUSED_DEPUTY_RISK | medium/high | Local MCP surface + agent/browser trust boundary |
Project structure
defensive-mcp-audit/
├── defensive_mcp_audit/ # Core package
├── checks/ # Plugin checks
├── action/ # Composite GitHub Action
├── tests/
├── SKILL.md # Agent skill integration
└── .github/
Development
pip install -e ".[dev]"
python -m unittest discover -s tests -v
See CONTRIBUTING.md and SECURITY.md.
Roadmap
- Plugin architecture (#1)
- MCP config discovery (#2)
- Composite GitHub Action
- PyPI trusted publishing workflow
- Docker / container runtime inspection
- Historical risk trending
Ethics
Strictly defensive. Read-only inspection. No exploitation, payloads, or network attacks.
License
MIT — see LICENSE.
Flagship integration
This project remains independently usable and is not deprecated. Its capabilities are also consumed by AetherOS and AegisAI, where they are integrated with complementary repositories behind shared platform contracts. This repository remains the source of truth for its component-specific implementation.