Model Context Protocol (MCP) endpoint security auditor
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"vamp-mcp-audit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
<!-- © VampSecure Studios — VampSecure Labs Security Research Division --> <img src="https://github.com/Vampsecure-Labs/vamp-mcp-audit/actions/workflows/ci.yml/badge.svg" alt="CI"/> # vamp-mcp-audit **VampSecure Labs · Security Research Division** Auditor de seguridad profesional para servidores MCP (Model Context Protocol) y configuraciones de agentes IA. Detecta vulnerabilidades en servidores MCP mediante 5 fases de auditoría especializadas. Incluye detección de **ASCII smuggling** (Unicode Tags invisibles), tool poisoning con dataset curado de 55 payloads reales y evaluación OWASP Agentic AI Top 10 2026. Primera herramienta OSS con detección de ASCII smuggling en campos MCP. --- ## Instalación ```bash pip install vamp-mcp-audit # o con Homebrew: brew install vampsecure-labs/labs/vamp-mcp-audit ``` ```bash pip install -r requirements.txt ``` **Requisitos:** Python 3.11+ --- ## Uso ```bash # Auditoría básica con output en consola python vamp_mcp_audit.py --target http://localhost:3000 # Con informes JSON y HTML python vamp_mcp_audit.py --target https://mcp.example.com --json report.json --html report.html # Con timeout personalizado y output detallado python vamp_mcp_audit.py --target http://127.0.0.1:8080 --timeout 15 --verbose ``` ### Argumentos | Argumento | Descripción | |----------------|----------------------------------------------------------| | `--target URL` | URL del servidor MCP a auditar (obligatorio) | | `--json FILE` | Exportar informe completo en JSON | | `--html FILE` | Exportar informe visual dark-theme en HTML | | `--scope FILE` | Fichero JSON de restricciones de scope (opcional) | | `--timeout N` | Timeout HTTP en segundos (por defecto: 10) | | `--vscode-config DIRECTORIO` | Auditoría de configuración VS Code/Cursor MCP (Fase 11) | | `--verbose` | Output de depuración detallado …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.