# Mcp Audit

> >

- **Type:** Skill
- **Install:** `agentstack add skill-hoangsonww-claude-code-agent-monitor-mcp-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [hoangsonww](https://agentstack.voostack.com/s/hoangsonww)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [hoangsonww](https://github.com/hoangsonww)
- **Source:** https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-config/skills/mcp-audit
- **Website:** https://hoangsonww.github.io/Claude-Code-Agent-Monitor/

## Install

```sh
agentstack add skill-hoangsonww-claude-code-agent-monitor-mcp-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP Audit

Inventory and audit every Model Context Protocol server the user has
configured — both user-scope and project-scope — read through the Agent Monitor
dashboard at `http://localhost:4820`.

## Input

The user provides: **$ARGUMENTS**

This may be:
- empty — audit all MCP servers (default).
- a server name fragment — focus on matching servers.
- "stdio" / "http" — restrict to one transport kind.

## Data Sources

| Endpoint | Returns |
|----------|---------|
| `GET /api/cc-config/mcp` | `{ user:[…], projectScoped:[…] }`. Each server: `{ name, source, kind }` where `kind` is `stdio` (with `command, args, envNames`), `http` (with `url, headers`), or `unknown`. `source` names the file the definition came from (e.g. `~/.claude.json (top-level)`, `~/.claude.json (projects[])`, `~/.claude/settings.json`) |

## Report Sections

### 1. Server inventory
List every server from `user` and `projectScoped`. For each show `name`,
`source`, `kind`, and the transport detail:
- **stdio** — the `command`, its `args`, and the `envNames` (names only — values
  are not exposed by the API).
- **http** — the `url` and the `headers` key names (values not exposed).
- **unknown** — a definition the server could not classify; flag it for review.

### 2. Scope split & duplication
Separate user-scope from project-scope servers. Flag any `name` that appears in
both scopes (project may shadow user) and any duplicate definitions across
source files.

### 3. Hygiene flags
- **Unknown transport** — servers with `kind: "unknown"` (malformed or
  unsupported definition).
- **Env reliance** — stdio servers with many `envNames`; note they depend on
  environment variables being present at launch.
- **Remote endpoints** — http servers; surface the `url` host so the user can
  confirm they trust the remote.

## Output

- Section 1 as a table (`Scope | Name | Kind | Transport detail | Source`).
- Env names and header names listed by name only — never invent or print values
  (the API does not expose them).
- Cite only fields the API returned — never fabricate servers, commands, or
  hosts.
- Note: MCP servers are read-only via the Config Explorer (they are written
  concurrently by the running CLI); edit their definitions in the source file
  named by `source`.
- If the dashboard is unreachable at `http://localhost:4820`, say so and tell
  the user to start it with `npm start` from the repo root.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hoangsonww](https://github.com/hoangsonww)
- **Source:** [hoangsonww/Claude-Code-Agent-Monitor](https://github.com/hoangsonww/Claude-Code-Agent-Monitor)
- **License:** MIT
- **Homepage:** https://hoangsonww.github.io/Claude-Code-Agent-Monitor/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hoangsonww-claude-code-agent-monitor-mcp-audit
- Seller: https://agentstack.voostack.com/s/hoangsonww
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.