ModelContextProtocol-Security

Mcpserver Audit — Security skill for Claude Code

Security community intermediate

Pre-use safety examination tool with vulnerability database.

How to install Mcpserver Audit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open ModelContextProtocol-Security/mcpserver-audit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Mcpserver Audit does

**Code audit tool that finds security vulnerabilities in MCP servers and Claude Desktop Extensions - because anyone can build them, but not everyone builds them safely.**

Alternatives in Security

Google Workspace Model Armor — Filter user-generated content for safety 21.6k ★
Skills — Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows 4k ★
Skill Audit — Audit codebases for quality, consistency, and broken patterns — use for pre-release or tech debt review 2.8k ★

README

MCP Server Audit

**Code audit tool that finds security vulnerabilities in MCP servers and Claude Desktop Extensions - because anyone can build them, but not everyone builds them safely.**

Why This Tool Exists

**Anyone can create MCP servers and Desktop Extensions** - no programming experience required. Here's how easy it is:

Example: Building a Desktop Extension (No Programming Needed)

As Anthropic states in their [official blog post](https://www.anthropic.com/engineering/desktop-extensions):

"Internally at Anthropic, we have found that Claude is great at building extensions with minimal intervention. If you too want to use Claude Code, we recommend that you briefly explain what you want your extension to do and then add the following context to the prompt:"

Simply paste this into Claude or any AI assistant:

I want to build this as a Desktop Extension, abbreviated as "DXT". Please follow these steps:

1. **Read the specifications thoroughly:**
   - https://github.com/anthropics/dxt/blob/main/README.md - DXT architecture overview, capabilities, and integration patterns
   - https://github.com/anthropics/dxt/blob/main/MANIFEST.md - Complete extension manifest structure and field definitions
   - https://github.com/anthropics/dxt/tree/main/examples - Reference implementations including a "Hello World" example

2. **Create a proper extension structure:**
   - Generate a valid manifest.json following the MANIFEST.md spec
   - Implement an MCP server using @modelcontextprotocol/sdk with proper tool definitions
   - Include proper error handling and timeout management

3. **Follow best development practices:**
   - Implement proper MCP protocol communication via stdio transport
   - Structure tools with clear schemas, validation, and consistent JSON responses
   - Make use of the fact that this extension will be running locally
   - Add appropriate logging and debugging capabilities
   - Include proper documentation and setup instructions


...