agent-audit

Security auditor for AI agent configurations. One command that scans your repo for MCP server configs, Claude Code settings, agent definitions, skills and hooks — and tells you where an attacker (or a single prompt-injected instruction) could hurt you.

$ npx agent-audit .

agent-audit — scanned 3 config file(s) in /work/my-app

.mcp.json
  ✖ error  [MCP003]:11
     Anthropic API key committed in plain text — anyone with repo access (and
     every agent reading this config) can use it. Move it to an environment reference.
     ↳ sk-a…234 (44 chars)
  ✖ error  [MCP005]:17
     A command pipes a network download straight into a shell — the remote host
     executes arbitrary code on this machine.
  ▲ warning  [MCP002]:5
     Server "filesystem" runs npx @modelcontextprotocol/server-filesystem without
     a pinned version — every launch pulls whatever was published last.

Result: 2 error(s), 1 warning(s)

Why

Agentic tooling exploded, and with it a new attack surface that classic linters and secret scanners don't cover:

• MCP servers are executables you invite in. An unpinned npx some-mcp is a supply-chain attack waiting for its next npm publish.
• Permissions are the blast radius. Bash(*) or bypassPermissions turns any successful prompt injection into arbitrary code execution — no human in the loop.
• Instructions are code now. Skills and agent files from marketplaces can carry injection payloads ("ignore previous instructions…", hidden base64, remote instruction fetches).
• Hooks run unattended. A hook that curls your transcript somewhere is an always-on exfiltration channel.

agent-audit makes these visible in seconds, locally and in CI.

Install & run

npx agent-audit            # audit the current directory
npx agent-audit path/to/repo
npx agent-audit --json     # machine-readable output
npx agent-audit --fail-on warning   # stricter CI gate (default: error)

Zero runtime dependencies. Node ≥ 20.

CI example (GitHub Actions)

- name: Audit agent configs
  run: npx agent-audit --fail-on warning

What it checks

Rule	Severity	What it catches
MCP001	error	Remote MCP server over plain http://
MCP002	warning	npx/uvx/bunx server without a pinned version (supply chain)
MCP003	error/warning	API keys & tokens committed inline (values are redacted in output)
MCP004	error/warning	Filesystem server rooted at / or the whole home directory
MCP005	error	curl … | bash style remote code execution in commands
CC001	error/warning	Blanket tool permissions (Bash(*), *) in Claude Code settings
CC002	error	bypassPermissions / dangerouslySkipPermissions
CC003	warning	Hooks shipping data to remote hosts
AG001	warning	Agent that combines shell execution with outbound network tools
SK001	warning	Prompt-injection markers in skills/agents (override phrases, remote instruction fetches, large base64 blobs)

What it scans

• .mcp.json, mcp.json, claude_desktop_config.json, .vscode/mcp.json
• .claude/settings.json, .claude/settings.local.json (permissions + hooks)
• .claude/agents/*.md, .claude/skills/**/*.md, .claude/commands/*.md

Library usage

import { audit } from 'agent-audit';

const { findings } = audit('/path/to/repo');

Roadmap

• --fix for auto-pinnable findings
• Config dialects: Cursor, Windsurf, Zed, Codex
• SARIF output for GitHub code scanning
• Allowlist file (.agentauditrc) for accepted risks
• Rule plugins

Development

npm install
npm test        # vitest
npm run dev -- tests/fixtures/vulnerable   # run the CLI against a fixture

License

MIT © Ondřej Úlehla