{“@context”: “https://schema.org”, “@type”: “FAQPage”, “mainEntity”: [{“@type”: “Question”, “name”: “Vs AI Code Scanner?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “AI Code Scanner finds general LLM integration anti-patterns; Server Auditor focuses on MCP tool definitions.”}}, {“@type”: “Question”, “name”: “False positives?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Heuristic — designed for low FP, still review findings manually.”}}, {“@type”: “Question”, “name”: “API key?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “No — fully local/filesystem.”}}]}

MCP guide · Server Auditor

MCP Server Auditor: audit MCP tool definitions — @guardbee/mcp-server-auditor

@guardbee/mcp-server-auditor scans other MCP servers’ server.tool(...) definitions for insecure patterns. Where AI Code Scanner looks at general LLM integration code, this package focuses on MCP tool privilege, schema looseness, and raw tool input flowing into dangerous sinks (shell / FS / HTTP / SQL).

What does it do?

It flags risks like execSync(input.command), eval of tool input, names like run_shell, path-traversal FS writes, allowlist-free fetch(input.url), SQL template injection, z.any() schemas, hardcoded secrets in schema defaults, full process.env exposure, and wildcard CORS — each finding includes a recommendation.

Who is it for?

Teams shipping their own MCP servers
Security/platform teams onboarding third-party MCPs
Teams adding an MCP security gate with SARIF in CI
Developers reviewing MCP code inside Claude or Cursor

What it is not

General app / LLM-integration SAST (use AI Code Scanner)
RAG/document prompt-injection scanning (use Prompt Injection Scanner)
Runtime exploit verification

Features

Feature	Description
10 patterns / 5 categories	excessive-agency, unsafe-input, loose-schema, secrets-exposure, network-exposure
Recommendations	Why it’s risky and what to do
SARIF 2.1.0	GitHub Code Scanning-ready output
guardbee.yml	fail-on, max-files, exclude rules
Local scan	No Guardbee API key

MCP tools

Tool	Description
`scan_text`	Scan a text/code snippet
`scan_file`	Single file
`scan_directory`	Directory (skips node_modules, .git, dist)
`list_patterns`	List supported patterns

Install with npm

Global install (handy for Claude Desktop / Cursor):

bash

npm install -g @guardbee/mcp-server-auditor

or via npx (recommended with -y in config):

bash

npx -y @guardbee/mcp-server-auditor

npm: @guardbee/mcp-server-auditor

CLI: npx @guardbee/mcp-server-auditor scan ./src --fail-on=high --format=sarif > results.sarif. Opt out of telemetry with GUARDBEE_TELEMETRY=0.

Claude Desktop configuration

Config file paths:

macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json
Linux~/.config/Claude/claude_desktop_config.json

Merge this block, then restart Claude Desktop:

claude_desktop_config.json

{
  "mcpServers": {
    "guardbee-mcp-server-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-server-auditor"
      ]
    }
  }
}

Cursor and other MCP clients

In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.

Example prompts in Claude

“Audit this MCP server source for security issues: /Users/me/my-mcp/src”
“Does this tool handler risk SSRF or shell execution?”
“Which patterns do you support? list_patterns”

See surface risk with Guardbee

MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.

Start free MCP servers

Frequently asked questions

Vs AI Code Scanner?

AI Code Scanner finds general LLM integration anti-patterns; Server Auditor focuses on MCP tool definitions.

False positives?

Heuristic — designed for low FP, still review findings manually.

API key?

No — fully local/filesystem.

MCP Server Auditor: audit MCP tool definitions