mcp-audit

1# MCP Audit
2 
3Inventory and audit every Model Context Protocol server the user has
4configured — both user-scope and project-scope — read through the Agent Monitor
5dashboard at `http://localhost:4820`.
6 
7## Input
8 
9The user provides: **$ARGUMENTS**
10 
11This may be:
12- empty — audit all MCP servers (default).
13- a server name fragment — focus on matching servers.
14- "stdio" / "http" — restrict to one transport kind.
15 
16## Data Sources
17 
18| Endpoint | Returns |
19|----------|---------|
20| `GET /api/cc-config/mcp` | `{ user:[…], projectScoped:[…] }`. Each server: `{ name, source, kind }` where `kind` is `stdio` (with `command, args, envNames`), `http` (with `url, headers`), or `unknown`. `source` names the file the definition came from (e.g. `~/.claude.json (top-level)`, `~/.claude.json (projects[<root>])`, `~/.claude/settings.json`) |
21 
22## Report Sections
23 
24### 1. Server inventory
25List every server from `user` and `projectScoped`. For each show `name`,
26`source`, `kind`, and the transport detail:
27- **stdio** — the `command`, its `args`, and the `envNames` (names only — values
28  are not exposed by the API).
29- **http** — the `url` and the `headers` key names (values not exposed).
30- **unknown** — a definition the server could not classify; flag it for review.
31 
32### 2. Scope split & duplication
33Separate user-scope from project-scope servers. Flag any `name` that appears in
34both scopes (project may shadow user) and any duplicate definitions across
35source files.
36 
37### 3. Hygiene flags
38…