Your AI agent's config file is a supply-chain problem now

What it does

mcp-audit-tool statically analyzes the MCP configuration files used by AI coding assistants — Claude Desktop, Cursor, Windsurf, Cline, Zed, VS Code — and grades them A+ through F. It auto-discovers configs across macOS, Linux, and Windows, then applies 12 detection rules mapped to CWEs and the OWASP MCP Top 10. Findings come with concrete remediation advice, not just a red flag.

The interesting bit

The attack surface it targets is genuinely novel: a single line in claude_desktop_config.json can leak credentials, fetch an unpinned package on every launch (the “rug pull”), or inject hidden instructions directly into the model’s context via tool descriptions. This is a linter for the seam where your LLM meets your filesystem and shell — a place most security tooling doesn’t look yet.

Key highlights

• 12 rules covering secrets, command injection, tool poisoning, insecure transport, wildcard permissions, and more
• Zero-config auto-discovery of client configs across all three major OSes
• SARIF 2.1.0 output plus severity-threshold exit codes for CI gating
• Pure Python 3.9+ with only three dependencies (typer, rich, pyyaml) — no Node, no Docker, no API keys
• Extensible rule engine: a new rule is one small function

Caveats

• It’s static analysis only — runtime rug-pull detection (diffing live tools/list against pinned hashes) is on the roadmap, not shipped
• The tool-poisoning rule matches indicators in descriptions; an ML-based prompt-injection classifier is also still planned
• The README’s “one-line installer” is oddly an npm install of a GitHub repo for a tool that insists it needs no Node.js

Verdict

Anyone running MCP servers in Claude Desktop, Cursor, or similar clients should run this once — the vulnerable example config scoring 12/100 makes the point fast. If you don’t use MCP tooling, there’s nothing here for you.