audit-mcp-cli

A lightweight dependency vulnerability audit tool for Node.js projects. Supports CLI and MCP Server modes, covers npm and pnpm projects, and generates structured Markdown/HTML reports with full dependency chains.

- Full dependency chains— traces the complete path from your package.json to each vulnerable package
- npm + pnpm support— auto-detects package manager by lockfile
- Remote GitHub audit— audit any public or private repo without cloning
- MCP Server— integrates with AI coding assistants (Claude, Cursor, etc.)
- Markdown / HTML reports— clean, structured reports sorted by severity
- CI gate—--fail-onexit code for CI/CD pipelines
- Ignore mechanism— suppress accepted vulnerabilities with expiration dates
- Severity filtering— show only vulnerabilities above a threshold

# Run directly npx audit-mcp-cli # Or install globally npm install -g audit-mcp-cli

# Audit current directory audit-mcp-cli # Specific project path audit-mcp-cli --path /path/to/project # Remote GitHub repo (branch) audit-mcp-cli --remote github:facebook/react --ref main # Remote GitHub repo (tag) audit-mcp-cli --remote github:facebook/react --ref v18.2.0 # Remote GitHub repo (commit SHA) audit-mcp-cli --remote github:facebook/react --ref abc123def # HTML report audit-mcp-cli --format html --output report.html # CI: fail if high+ severity vulnerabilities found audit-mcp-cli --fail-on high # Severity filtering (only show high and critical) audit-mcp-cli --severity high

Run as an MCP stdio server for AI assistants:

Basic (local projects & public repos):

{ "mcpServers": { "audit-mcp-cli": { "command": "npx", "args": ["-y", "audit-mcp-cli", "--mcp"] } } }

With GitHub token (private repos / avoid rate limits):

{ "mcpServers": { "audit-mcp-cli": { "command": "npx", "args": ["-y", "audit-mcp-cli", "--mcp"], "env": { "GITHUB_TOKEN": "ghp_xxxx" } } } }

Basic (local projects & public repos):

{ "mcpServers": { "audit-mcp-cli": { "command": "npx", "args": ["-y", "audit-mcp-cli", "--mcp"] } } }

With GitHub token (private repos / avoid rate limits):

{ "mcpServers": { "audit-mcp-cli": { "command": "npx", "args": ["-y", "audit-mcp-cli", "--mcp"], "env": { "GITHUB_TOKEN": "ghp_xxxx" } } } }

The MCP server exposes one tool that supports both local and remote auditing:

Returns: report file path + structured vulnerability details (CVSS, dependency chains, fix suggestions).

Token is optional.Local project auditing never requires a token. Remote public repos work without a token (60 requests/hour). Only private repos require a GitHub token.

Create.audit-mcp-cli-ignore.jsonin your project root to suppress accepted vulnerabilities:

{ "ignore": [ { "packageName": "minimist", "advisorySource": 1179, "reason": "Accepted risk, limited impact in our usage", "expiresAt": "2025-12-31T00:00:00Z" } ] }

- packageName— match all advisories for this package, or combine withadvisorySourcefor exact match
- expiresAt— optional, ignore auto-expires after this date
- Ignored vulnerabilities are shown in a separate section of the report and excluded from--fail-onchecks

# GitHub Actions example - name: Security Audit run: npx audit-mcp-cli --fail-on high

# Generic CI npx audit-mcp-cli --fail-on high && echo "pass" || echo "fail"

AI code security scanner with 100 built-in rules covering OWASP Top 10 and CWE Top 25

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.

Remediate vulnerabilities found by Contrast products using LLM and Coding Agent capabilities.

Provides AI agents with access to development best practices, security guidelines, and coding standards.

Hound is a free, open-source MCP server that gives AI coding agents a nose for supply chain security. It scans packages for vulnerabilities, checks licenses, inspects dependency trees, and detects typosquatting — with zero API keys, zero config, and zero cost.

Stop AI coding agents from leaking your API keys. Local proxy + MCP that swaps real secrets for phm_ tokens. Works with Claude Code, Cursor, Windsurf, and Codex.

Skill router and context picker for coding agents — hybrid retrieval + rerank picks the right skill; an ONNX prompt-injection gate scans both the request and every retrieved doc.

17 developer tools for AI agents — JSON, JWT, regex with code gen, cron from English, secrets scanner, batch ops. 7 free, 10 Pro ($7).

A sandboxed, agentic workspace providing secure filesystem, bash, and uv-powered Python execution.

Run Shipcheck repo risk scans from MCP coding agents.