MCP Audit

Inventory and audit every Model Context Protocol server the user has configured, both user-scope and project-scope, read through the Agent Monitor dashboard at http://localhost:4820.

Input

The user provides: $ARGUMENTS

This may be:

• empty, audit all MCP servers (default).
• a server name fragment, focus on matching servers.
• "stdio" / "http", restrict to one transport kind.

Data Sources

Endpoint	Returns
GET /api/cc-config/mcp	{ user:[…], projectScoped:[…] }. Each server: { name, source, kind } where kind is stdio (with command, args, envNames), http (with url, headers), or unknown. source names the file the definition came from (e.g. ~/.claude.json (top-level), ~/.claude.json (projects[<root>]), ~/.claude/settings.json)

Report Sections

1. Server inventory

List every server from user and projectScoped. For each show name, source, kind, and the transport detail:

• stdio, the command, its args, and the envNames (names only, values are not exposed by the API).
• http, the url and the headers key names (values not exposed).
• unknown, a definition the server could not classify; flag it for review.

2. Scope split & duplication

Separate user-scope from project-scope servers. Flag any name that appears in both scopes (project may shadow user) and any duplicate definitions across source files.

3. Hygiene flags

• Unknown transport, servers with kind: "unknown" (malformed or unsupported definition).
• Env reliance, stdio servers with many envNames; note they depend on environment variables being present at launch.
• Remote endpoints, http servers; surface the url host so the user can confirm they trust the remote.

Output