openauditA100out of 100: openaudit's audit of itself

Guide

Audit your MCP servers and AI agent setup

Run openaudit . in your repo. The code.agent-config auditor reads your MCP configs, agent instruction files and agent permission settings, and reports what an attacker could abuse. It only parses files. Nothing in them is executed.

What can go wrong

  • An MCP config launches npx -y some-server with no version, so every start runs whatever the registry serves that day.
  • A token sits in plain text in .mcp.json, and anyone who can read the repo can use it.
  • An AGENTS.md or Cursor rule hides an instruction in an HTML comment or invisible Unicode. The agent reads it. Your reviewer doesn't see it.
  • Committed settings pre-approve every shell command, so one prompt injection in an issue or web page becomes code execution.

What openaudit checks

code.agent-config covers AGENTS.md, GEMINI.md, Cursor, Copilot, Windsurf and Cline rules, .mcp.json, Cursor and Claude Desktop MCP configs, .claude/settings.json, Gemini CLI settings and .codex/config.toml. Rule ids include:

  • mcp-unpinned-server: an npm package or Docker image launched without an exact version.
  • mcp-plaintext-http: a remote MCP server reached over http://.
  • mcp-inline-credential: a literal credential in a server's config.
  • mcp-auto-approve: enableAllProjectMcpServers: true in Claude Code settings.
  • mcp-server-trusted: trust: true on a Gemini CLI MCP server.
  • broad-permission and permission-bypass-mode: every Bash command pre-approved, bypassPermissions, or a Codex config with sandbox_mode = "danger-full-access".
  • hidden-instruction, instruction-disables-safety and the hidden-unicode-* rules: the prompt-injection checks for instruction files.

Findings carry OWASP Top 10 for LLM Applications tags: owasp-llm01 (prompt injection), owasp-llm03 (supply chain) and owasp-llm06 (excessive agency). code.unicode also scans code and docs for hidden Unicode.

For your MCP server's own code, the agent playbooks add a judgment review. agent.injection traces input to sinks such as SQL, shell commands, SSRF and file paths. agent.authz looks for missing auth and privilege escalation. agent.secrets-config looks for secrets in logs, bundles and CI, and for over-broad IAM.

How to run it

Only the agent config checks:

openaudit . --only code.agent-config

The playbooks headlessly with Claude. They're opt-in and need ANTHROPIC_API_KEY or a Claude Code login:

openaudit . --agentic --only agent.injection,agent.authz,agent.secrets-config

Or let the agent you already use run them. Add openaudit as an MCP server in Claude Code:

claude mcp add openaudit -- bunx @openaudit/cli mcp

Cursor and Codex take the same bunx @openaudit/cli mcp command in their MCP config. Your agent calls get_playbook, reviews the code with its own tools and sends results back with submit_findings. That route needs no extra API key.

In CI, --fail-on high makes the run exit 1 on high or critical findings.

What it doesn't cover

  • It doesn't connect to a running MCP server or probe a remote MCP endpoint. These checks read files in the repo.
  • It doesn't inspect tool descriptions that a server returns at runtime.
  • It can't tell whether a pinned package is safe, only that it's pinned.
  • The playbooks aren't MCP-specific. They review your server as ordinary code.
  • The hidden-instruction rules are heuristics with low confidence. Read the raw file before you act.

Next steps