AUTOMATED MCP SECURITY AUDIT

Audit Your MCP Server in Seconds.

Instant static verification for Model Context Protocol servers. Detect command injection, path traversal, hardcoded tokens, and tool contract drift before agents touch your code.

Initial Turnkey Hardened Configs: 📁 Filesystem MCP Hardened Launch Config 💻 Shell/Terminal MCP Hardened Launch Config

Connecting to repository...

Free Findings Preview (Top Issues)

Automated Hardening for `Your Repository`

Don't manually patch path boundaries, shell escapes, and environment leaks. Generate your repository-specific security diff, runtime policy, and regression tests with one click.

100% Free Intent Check · Zero Wallet Needed · Preview Exact Generated Files

✔ Deliverable Files Generated Specifically for Target Repo Scope: +48 / -6 lines

1. src/security-guard.ts Boundary enforcement: safeResolvePath() & sanitizeCommand()

2. claude_desktop_config.json Hardened launch config with environment flags & jail parameters

3. mcp-security.json Production policy: path whitelist, shell restrictions, token masks

4. test/security-guard.regression.test.ts 3 Vitest regression tests (path traversal, shell injection, secrets)

Synthesized Policy & Diff Scope Preview:
+ safeResolvePath(baseDir, requestedPath): prevents directory escape beyond root
+ sanitizeCommand(binary, args): enforces argument array vector without subshell
+ Vitest Suite: 3 passing tests validating boundary invariants

Option 1: Config Only $1 USDC

Download Exact Hardened Config

Instant drop-in claude_desktop_config.json & Cursor configuration snippet with environment jailing flags and path isolation.

✔ claude_desktop_config.json snippet

✔ Cursor launch arguments

✔ Signed scan evidence badge

Option 2: Complete Bundle $3 USDC

Ready-to-Apply Security Bundle

Full production engineering patch ready to merge. Includes unified Git diff, runtime guards, Vitest regression tests, and policy file.

✔ Unified Git Diff (git apply ready)

✔ Hardened mcp-security.json policy

✔ Automated Vitest regression tests

✔ safeResolvePath & sanitizeCommand modules

Direct on-chain settlement on Base. Instant automated code download. Zero sign-up. Zero KYC.

Treasury (Base USDC): 0xC6F86e170411182114FcCdb28793dC76B5e8D144

Host Protection & Safe Execution for `This MCP Server`

Don't run community MCP servers with unrestricted access to your home directory, SSH keys, or shell. Synthesize the exact sandboxed configuration snippet to safely isolate this server.

100% Free Intent Check · Zero Wallet Needed · Preview Sandboxed Profile

✔ Sandboxed Runtime Manifest for Target Repo Host Confinement Profile

1. claude_desktop_config.json Drop-in confined server entry with workspace path boundary flags

2. cursor-mcp-settings.json Cursor IDE configuration with environment token masking

3. mcp-runtime-jail.sh Lightweight process wrapper preventing unauthorized host subshells

4. confinement-audit.md Threat model report confirming host data exposure risk is neutralized

Option 1: Config Snippet $1 USDC

Drop-in Claude / Cursor Config

Ready-to-paste JSON snippet with isolated workspace directories and environment restrictions.

✔ claude_desktop_config.json snippet

✔ Cursor MCP configuration

✔ Signed scan evidence badge

Option 2: Complete Host Pack $3 USDC

Full Host Confinement Pack

Complete host protection: drop-in config, runtime security wrapper, credentials masking rule, and Vitest test harness.

✔ Claude & Cursor launch configs

✔ Runtime isolation wrapper script

✔ Vitest regression test suite

✔ Full host exposure threat model

Direct on-chain settlement on Base. Instant config download. Zero sign-up. Zero KYC.

Treasury (Base USDC): 0xC6F86e170411182114FcCdb28793dC76B5e8D144

GENESIS Agent Transaction Guard $0.05 USDC on Base

Pre-flight deterministic verification before autonomous agents execute financial actions on Base or EVM chains. Eliminates infinite token approvals, zero-address burning, and unauthorized delegatecall exploits.

✔ Allowance Sentinel: Blocks MaxUint256 unlimited approvals

✔ Address Validator: Rejects 0x0...0 burn destinations & malformed hex

✔ Threshold Monitor: Flags abnormal single-tx volume spikes

✔ Machine Verdict: Machine-consumable ALLOW / WARN / BLOCK JSON

🛡 Autonomous Agent Risk Protection Matrix

Real-world agent failures caught and blocked deterministically before broadcast on Base:

BLOCKED: Unlimited Approvals

Catches MaxUint256 allowance requests from rogue/hallucinated prompts.

BLOCKED: Zero-Address Drain

Rejects uninitialized 0x000...000 burn/drain destinations.

FLAGGED: Outlier Volume Spikes

Blocks single-tx volume excursions exceeding configured safety limits.

Interactive Guard Test:

Protect Your Autonomous Agent Pipeline

Add pre-flight transaction verification to your AgentKit, LangChain, or custom Python agent in 3 lines of code.

Zero Wallet Needed · View Integration Snippet & SDK Architecture

✔ Payment Settled & Remediation Delivered!

1. Unified Git Patch (src/security-guard.ts)

Verified Security Benchmarks from Public MCP Repositories

MCP Filesystem Server

Verified against symlink path traversal. The remediation patch implements canonical root directory jailing via safeResolvePath(), preventing arbitrary reads of sensitive host files like /etc/passwd.

Shell & Terminal MCP Servers

Audited for arbitrary command execution. Replaces unescaped shell concatenation with argument vector array enforcement and an explicit binary whitelist (git, npm, node).

Web Search & Scraper MCP Servers

Audited for prompt injection surfaces. Employs content delimiter encapsulation and secret token masking to eliminate indirect prompt poisoning from third-party websites.