karanb192

MCP Sprawl Audit — Security skill for Claude Code

Security community

Counts how many copies of each MCP server your Claude Code, Codex and Grok sessions are running, and plans which to share, remove or keep.

How to install MCP Sprawl Audit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open karanb192/mcp-sprawl-audit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MCP Sprawl Audit does

Counts how many copies of each MCP server your Claude Code, Codex and Grok sessions are running, and plans which to share, remove or keep. Read-only.

Alternatives in Security

Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
Audit Agent Sessions — Analyze all agent sessions from the last 3 days across Claude, Codex, and Gemini 238 ★

README

mcp-sprawl-audit

Every Claude Code, Codex or Grok session starts its own copy of each local MCP server in its config. With many sessions open, that adds up to hundreds of processes and gigabytes of memory, most of it waiting for a tool call that never comes.

This is an agent skill and a single Python script that measures that on your machine and writes a plan. It is read-only: it changes no config and touches no process. It reads the names of env vars and headers, never their values. From a command line it prints only a package name or a script's file name, and from a URL only the scheme and host, because the rest can carry keys.

[Why this exists](https://karanbansal.in/blog/mcp-sprawl/) tells the story of 57 agent sessions running 646 MCP server processes on one laptop, and how sharing three servers over localhost took them from 19.5 GB to 301 MB.

Use it

Hand it to your agent:

Clone https://github.com/karanb192/mcp-sprawl-audit and follow its SKILL.md to audit my MCP servers.

Or install it as a skill, so any session can run it:

git clone https://github.com/karanb192/mcp-sprawl-audit ~/.claude/skills/mcp-sprawl-audit   # Claude Code, and Grok reads this folder too
git clone https://github.com/karanb192/mcp-sprawl-audit ~/.codex/skills/mcp-sprawl-audit    # Codex CLI

Or run the script yourself. It needs only Python (3.11+ to read Codex and Grok TOML).

python3 scripts/audit.py           # Markdown report
python3 scripts/audit.py --json    # structured, for agents
python3 scripts/audit.py --no-usage --days 14

What it reports

Running agent sessions per agent, and every local MCP server copy they hold: processes, resident memory, idle npx or uvx launchers.
How often each server was actually called, from each agent's own session logs.
One action per server: share (serve one copy over HTTP on 127.0.0.1), use-hosted, keep, per-project, remove?, plugin (bundled, only its author can change it), `check