Question 1

What does this skill actually do?

Accepted Answer

It audits an MCP server the way a real client uses it, then scans the repository for credentials that shouldn't be there. The first script completes the handshake, enumerates tools/list, calls each read-only tool once, and compares the declared schema against the actual function signature. The second script fingerprints real credentials from a profile file or the environment and searches every store that can hold them — git objects, reflog, tags, SQLite WALs, logs, chat history, and compressed backups. Both scripts print findings to stdout and exit non-zero on anything they catch.

Question 2

What does it actually output?

Accepted Answer

Both scripts print human-readable findings to stdout and exit non-zero on any finding, so they work as a pre-merge gate without extra parsing. Each finding names the tool or file, the exact error or match, and a one-line suggested fix. Nothing is written to disk unless you pass --out <dir>, which emits a markdown report you can attach to a PR or hand to a reviewer. There is no JSON mode yet — if you need one for CI tooling, say so and it moves up the list.

Question 3

Which agents does this work with?

Accepted Answer

Any SKILL.md-compatible agent — Claude Code, Cursor, Codex CLI, OpenClaw, Gemini CLI, Copilot, Windsurf, Cline, Aider, VS Code, and 20+ others. The instructions run everywhere. The two shell scripts need bash.

Question 4

Does this skill work on Windows?

Accepted Answer

The SKILL.md instructions work in any agent. The two scripts need bash — run them under WSL, Git Bash, or a Linux/macOS machine. Native PowerShell won't execute them directly.

Question 5

Does it send my secrets anywhere?

Accepted Answer

No. leak_scan.sh reads credential values from a profile file or the environment, keeps only a sha256 prefix + length, and never prints or transmits the value. No network calls are made except optional git operations on the target repo.

Question 6

Is this a vulnerability scanner?

Accepted Answer

No. It catches correctness defects that break MCP tools (schema drift, wrong paths, missing binaries) and leaked credentials. It does not produce CVEs, and it will not overclaim one.

Question 7

My server is remote (HTTP/streamable), not stdio. Does it work?

Accepted Answer

The probe script speaks stdio only — the way a local client connects. For a remote server, the methodology still applies: enumerate tools, call each read-only tool once, diff the declared schema against the function signature, and verify answers against ground truth. You'll do that by hand or with your own client, but the checklist and the failure patterns it looks for are the same. If you have a local stdio bridge to your remote server, point the script at that and it runs unchanged.

Question 8

What if a tool fails — is that a security problem?

Accepted Answer

Usually no. A TypeError on every call is a dispatcher/signature mismatch: the tool is broken, not exploited. Report it as a defect with the exact error text.

Question 9

How is this different from a regex secret scanner?

Accepted Answer

Regex catches shapes and misses the value you actually rotated in. This fingerprints the real credential and searches every store that can hold it — git objects, reflog, tags, SQLite WALs, logs, chat history, and compressed backups.

Question 10

Can I use it in CI?

Accepted Answer

Yes — both scripts are non-interactive and exit non-zero on findings, so they fit a pre-merge gate. Keep the leak scan's profile input out of CI logs.

Question 11

What does the audit service add?

Accepted Answer

This skill is the self-serve version: you run it, you read the output, you fix what it finds. The paid service is for teams that want the work done for them — a written findings report, a schema↔signature diff across every tool, platform validation, and optional fix PRs with regression tests attached. Same checks, delivered as a result instead of a tool.

Category	Tool / Location	Severity	Issue	Recommended Fix
Dispatcher	`read_file`	High	`inputSchema` defines `encoding` but function signature lacks the parameter.	Add `encoding: str = "utf-8"` to function signature.
Path	`server.py:42`	Medium	Hard-coded path `/etc/zypp/` found; fails on non-SUSE environments.	Use `os.path.join` and verify via `shutil.which`.
Leak	`.env.backup`	Critical	`PUBLISHED`: Found `ghp_` prefix fingerprint in git history.	Rotate GitHub token and update `.gitignore`.
Dependency	`search_grep`	Low	Uses `which grep` shell-out; risk of false negatives.	Replace with `shutil.which('grep')`.

mcp audit

mcp audit

MCP Audit Results

Tool Health Summary

Detailed Findings

Summary

About this skill

How to use

Reviews

No reviews yet

Trust & safety

What's inside

Frequently Asked Questions

More screenshots

mcp audit

mcp audit

MCP Audit Results

Tool Health Summary

Detailed Findings

Summary

About this skill

Known limitations

How to use

Reviews

No reviews yet

Trust & safety

Permissions required

What's inside

Frequently Asked Questions

What does this skill actually do?

What does it actually output?

Which agents does this work with?

Does this skill work on Windows?

Does it send my secrets anywhere?

Is this a vulnerability scanner?

My server is remote (HTTP/streamable), not stdio. Does it work?

What if a tool fails — is that a security problem?

How is this different from a regex secret scanner?

Can I use it in CI?

What does the audit service add?