Reported issues for mcp-audit

Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to mcp-audit.

Most discussed

Collect first external redacted field report

Goal

Collect one external, redacted, config-only MCPAudit field report through the public field-report template.

Current release/context

MCPAudit v1.13.1 is live. The generator-to-auditor proof packet is now on main: https://github.com/saagpatel/MCPAudit/blob/main/docs/MCP-TRUST-PACKET.md

The trust packet explains the public story: mcpforge can scaffold or generate a reproducible MCP server, MCPAudit audits the trust boundary, and bridge-db stays local dogfood/receipt infrastructure

Read the thread · 2026-05-10 · open · 6 comments

Collect prompt/resource fixtures before composite scoring

Prompt and resource findings are now visible through non_tool_risk, reports, and policy gates. Before merging non-tool findings into risk_score.composite, collect more public or redacted real-world fixtures.

Acceptance criteria:

• Add at least three additional prompt/resource fixture families beyond the current GitHub, PostgreSQL, and Slack-style cases.
• Include benign cases that should not increase non_tool_risk.
• Document any scoring proposal before changing composite risk behavior.
• Keep

Read the thread · 2026-05-10 · closed · 2 comments

Track downstream dashboard JSON consumer needs

MCPAudit now includes JSON consumer examples, including a dashboard-oriented summary. Track feedback from real CI dashboards before adding more output contract surface area.

Acceptance criteria:

• Collect examples from at least two downstream dashboard or status-page consumers.
• Identify fields that are hard to consume or unstable.
• Prefer examples and documented patterns before adding new CLI flags.
• Keep JSON/SARIF changes additive before beta.

Read the thread · 2026-05-10 · closed · 2 comments

Record solo multi-environment evidence lane

What\n\nRecord MCPAudit's solo validation path separately from true external field reports.\n\n## Result\n\n- Added docs/SOLO-EVIDENCE.md with a repeatable solo checklist.\n- Recorded the 2026-05-10 solo config-only pass using the published 1.5.5 package.\n- Checked a clean virtual environment install path.\n- Checked a fixture-based config-only scan suitable for hosted or CI use.\n- Linked the solo lane from README, field-report, beta-readiness, and external-request docs.\n\n## Boundary\n\nT

Read the thread · 2026-05-10 · closed · 1 comment

ScanWarning: distinguish corrupted pin store from missing baseline (pin_store_corrupted code)

Found during the warnings-as-data review (PR #157), pre-existing behavior.

A pin file that exists but fails to parse (non-strict _load) degrades pinned_servers() to [] with only a logger.warning at the data layer. The engine then emits pin_baseline_missing — identical to the user never having run mcp-audit pin. A corrupted baseline is a materially different (and scarier) condition than an absent one: it can mask a wiped or tampered pin store.

Proposal: when the pin store read path

Read the thread · 2026-07-03 · closed · 0 comments

Record redacted field-report setup evidence

Document and fixture-test redacted field-report setup shapes from config-only scans, without spawning MCP servers or storing secrets.

Read the thread · 2026-05-10 · closed · 0 comments

Add output-contract upgrade compatibility tests

Add fixture-backed tests that older MCPAudit JSON reports still load through the current model, and that additive future fields do not break tolerant consumers.

Read the thread · 2026-05-10 · closed · 0 comments

Collect redacted config-health fixtures before new diagnostics

Collect or synthesize fixture-backed MCP client configs before adding more config-health diagnostics. Keep fixtures local, redacted, deterministic, and tied to existing scanner behavior until real feedback justifies new finding types.

Read the thread · 2026-05-10 · closed · 0 comments

Most recent

Add adoption smoke coverage for docs and examples

Add regression coverage that keeps the documented MCPAudit adoption paths copy-pasteable. Focus on GitHub Actions examples, policy examples, consumer examples, and docs links so examples cannot silently drift after releases.

Read the thread · 2026-05-10 · closed · 0 comments

The remaining reports are on the project's issue tracker.