wtf is mcp-audit?

mcp-audit is a tool for checking what MCP servers actually do when they run, rather than just trusting what they claim to do. MCP is a protocol that lets AI assistants connect to outside tools and services, and each connection is provided by a small server program. Most existing safety checks for these servers only look at the published source code, but this project watches the server's real behavior once it is running: every file it opens and every network connection it makes. The official registry only confirms who published a server, not what it does at runtime, and a server could change its behavior after you have already trusted an earlier version. This project aims to catch that gap. Each server is started inside a disposable Docker container and monitored with strace, a tool that records every system level action a program takes. A fake secret is planted in the environment as bait, so if a server tries to read or send it, that shows up in the log. The container is thrown away afterward, so nothing the server does affects the real computer running the audit. The project has already tested 70 real MCP servers. Most, 67 of them, showed no unusual file reads or network activity when starting up. Three made outbound connections to servers matching their stated purpose, and one server read a system file as part of a normal user account lookup, which was investigated and found harmless. None of the servers tested sent out the planted fake secret. Future plans include tracking behavior not just at startup but during actual tool calls, comparing a server's behavior across different versions to catch cases where a server changes after being trusted, and publishing ongoing behavior reports that other tools could check before installing a server. To run it yourself, you need Docker installed, then clone the repository and run the provided scripts, which install the tracing tool inside the container and process the results into a readable summary with a Python script. The project is written in Python and built by a single developer, who reports anything concerning to a server's maintainer privately before publishing findings.