Claude Skill

mcp-audit

Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each definition came from. Reads /api/cc-config/mcp. Use when reviewing MCP integrations

LLM Mart · 0 points · 9 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download hoangsonww-claude-code-agent-monitor-plugins_ccam-config_skills_mcp-audit-83d4df5.zip · 1 KB

hoangsonww/claude-code-agent-monitor 1014 238 forks MIT Updated 23h ago

Part of hoangsonww/claude-code-agent-monitor — 86 skills

Install

skills CLI npx skills add https://github.com/hoangsonww/Claude-Code-Agent-Monitor/tree/master/plugins/ccam-config/skills/mcp-audit

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install hoangsonww-claude-code-agent-monitor@llmmart

Git git clone https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole hoangsonww/claude-code-agent-monitor collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

MCP Audit

Inventory and audit every Model Context Protocol server the user has configured — both user-scope and project-scope — read through the Agent Monitor dashboard at http://localhost:4820.

Input

The user provides: $ARGUMENTS

This may be:

empty — audit all MCP servers (default).
a server name fragment — focus on matching servers.
"stdio" / "http" — restrict to one transport kind.

Data Sources

Endpoint	Returns
`GET /api/cc-config/mcp`	`{ user:[…], projectScoped:[…] }`. Each server: `{ name, source, kind }` where `kind` is `stdio` (with `command, args, envNames`), `http` (with `url, headers`), or `unknown`. `source` names the file the definition came from (e.g. `~/.claude.json (top-level)`, `~/.claude.json (projects[<root>])`, `~/.claude/settings.json`)

Report Sections

1. Server inventory

List every server from user and projectScoped. For each show name, source, kind, and the transport detail:

stdio — the command, its args, and the envNames (names only — values are not exposed by the API).
http — the url and the headers key names (values not exposed).
unknown — a definition the server could not classify; flag it for review.

2. Scope split & duplication

Separate user-scope from project-scope servers. Flag any name that appears in both scopes (project may shadow user) and any duplicate definitions across source files.

3. Hygiene flags

Unknown transport — servers with kind: "unknown" (malformed or unsupported definition).
Env reliance — stdio servers with many envNames; note they depend on environment variables being present at launch.
Remote endpoints — http servers; surface the url host so the user can confirm they trust the remote.

Output

Section 1 as a table (Scope | Name | Kind | Transport detail | Source).
Env names and header names listed by name only — never invent or print values (the API does not expose them).
Cite only fields the API returned — never fabricate servers, commands, or hosts.
Note: MCP servers are read-only via the Config Explorer (they are written concurrently by the running CLI); edit their definitions in the source file named by source.
If the dashboard is unreachable at http://localhost:4820, say so and tell the user to start it with npm start from the repo root.

Files (claude-code-agent-monitor)

agents

openai.yaml 259 B

interface:
  display_name: "Mcp Audit"
  short_description: "Audit the configured MCP servers (user + project scope) via..."
  default_prompt: "Use $mcp-audit to inspect CCAM data and complete this workflow safely."
policy:
  allow_implicit_invocation: false

SKILL.md 2.8 KB

---
name: mcp-audit
description: >
  Audit the configured MCP servers (user + project scope) via the Agent
  Monitor Config Explorer API: transport (stdio vs http), command/args and env
  variable names, headers, and the source file each definition came from.
  Reads /api/cc-config/mcp. Use when reviewing MCP integrations for hygiene,
  duplication, or unexpected transports.
---

# MCP Audit

Inventory and audit every Model Context Protocol server the user has
configured — both user-scope and project-scope — read through the Agent Monitor
dashboard at `http://localhost:4820`.

## Input

The user provides: **$ARGUMENTS**

This may be:
- empty — audit all MCP servers (default).
- a server name fragment — focus on matching servers.
- "stdio" / "http" — restrict to one transport kind.

## Data Sources

| Endpoint | Returns |
|----------|---------|
| `GET /api/cc-config/mcp` | `{ user:[…], projectScoped:[…] }`. Each server: `{ name, source, kind }` where `kind` is `stdio` (with `command, args, envNames`), `http` (with `url, headers`), or `unknown`. `source` names the file the definition came from (e.g. `~/.claude.json (top-level)`, `~/.claude.json (projects[<root>])`, `~/.claude/settings.json`) |

## Report Sections

### 1. Server inventory
List every server from `user` and `projectScoped`. For each show `name`,
`source`, `kind`, and the transport detail:
- **stdio** — the `command`, its `args`, and the `envNames` (names only — values
  are not exposed by the API).
- **http** — the `url` and the `headers` key names (values not exposed).
- **unknown** — a definition the server could not classify; flag it for review.

### 2. Scope split & duplication
Separate user-scope from project-scope servers. Flag any `name` that appears in
both scopes (project may shadow user) and any duplicate definitions across
source files.

### 3. Hygiene flags
- **Unknown transport** — servers with `kind: "unknown"` (malformed or
  unsupported definition).
- **Env reliance** — stdio servers with many `envNames`; note they depend on
  environment variables being present at launch.
- **Remote endpoints** — http servers; surface the `url` host so the user can
  confirm they trust the remote.

## Output

- Section 1 as a table (`Scope | Name | Kind | Transport detail | Source`).
- Env names and header names listed by name only — never invent or print values
  (the API does not expose them).
- Cite only fields the API returned — never fabricate servers, commands, or
  hosts.
- Note: MCP servers are read-only via the Config Explorer (they are written
  concurrently by the running CLI); edit their definitions in the source file
  named by `source`.
- If the dashboard is unreachable at `http://localhost:4820`, say so and tell
  the user to start it with `npm start` from the repo root.