# MCP Audit

Audit the configured MCP servers (user + project scope) via the Agent Monitor Config...

- Repository: https://github.com/hoangsonww/Claude-Code-Agent-Monitor (1136 stars)
- Category: AI and agents
- License: MIT
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -g -a claude-code -y`
Codex: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -g -a codex -y`
Cursor: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -g -a cursor -y`
Gemini CLI: `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add hoangsonww/Claude-Code-Agent-Monitor`

## Description

Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each definition came from. Reads /api/cc-config/mcp. Use when reviewing MCP integrations for hygiene, duplication, or unexpected transports.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# MCP Audit

Inventory and audit every Model Context Protocol server the user has
configured, both user-scope and project-scope, read through the Agent Monitor
dashboard at `http://localhost:4820`.

## Input

The user provides: **$ARGUMENTS**

This may be:
- empty, audit all MCP servers (default).
- a server name fragment, focus on matching servers.
- "stdio" / "http", restrict to one transport kind.

## Data Sources

| Endpoint | Returns |
|----------|---------|
| `GET /api/cc-config/mcp` | `{ user:[…], projectScoped:[…] }`. Each server: `{ name, source, kind }` where `kind` is `stdio` (with `command, args, envNames`), `http` (with `url, headers`), or `unknown`. `source` names the file the definition came from (e.g. `~/.claude.json (top-level)`, `~/.claude.json (projects[<root>])`, `~/.claude/settings.json`) |

## Report Sections

### 1. Server inventory
List every server from `user` and `projectScoped`. For each show `name`,
`source`, `kind`, and the transport detail:
- **stdio**, the `command`, its `args`, and the `envNames` (names only, values
  are not exposed by the API).
- **http**, the `url` and the `headers` key names (values not exposed).
- **unknown**, a definition the server could not classify; flag it for review.

### 2. Scope split & duplication
Separate user-scope from project-scope servers. Flag any `name` that appears in
both scopes (project may shadow user) and any duplicate definitions across
source files.

### 3. Hygiene flags
- **Unknown transport**, servers with `kind: "unknown"` (malformed or
  unsupported definition).
- **Env reliance**, stdio servers with many `envNames`; note they depend on
  environment variables being present at launch.
- **Remote endpoints**, http servers; surface the `url` host so the user can
  confirm they trust the remote.

## Output

The rest: https://github.com/hoangsonww/Claude-Code-Agent-Monitor/blob/HEAD/plugins/ccam-config/skills/mcp-audit/SKILL.md