Immutable. This exact content is served forever at /api/v1/blob/4ac915648774b7cd.
---
name: defensive-mcp-audit
description: >
Runs a defensive, read-only security audit of the local machine for MCP and
AIagent risks: risky bindings, MCP config issues, and confused-deputy exposu
re.Use before enabling MCP servers or when the user says audit mcp, check lo
calhost exposure, mcp security. Outputs text, JSON, SARIF, or HTML. Triggers
: audit mcp, mcp security, defensive-mcp-audit. Use when the user needs this
capability.
version: 1.0.0
author: Stijnman
license: MIT
metadata:
grok:
tags: [audit mcp, mcp security, localhost exposure, defensive-mcp-audit]
related_skills: [exposed-service-triage, mcp-tool-scout, hitl-approver]
publication_reviewed: '2026-06-24'
compatibility: Grok agent; optional MCP and shell access
---
# Defensive Mcp Audit
## When to Use
- User says **audit mcp** or task matches this capability
- User says **mcp security** or task matches this capability
- User says **localhost exposure** or task matches this capability
- User says **defensive-mcp-audit** or task matches this capability
## Workflow
1. Confirm audit is read-only; no port scanning beyond localhost inventory.
2. Run: python3 -m defensive_mcp_audit (or pip install defensive-mcp-audit[cli]).
3. Parse risk_level, risk_score, and findings table.
4. Explain each finding in plain language with remediation (bind localhost, disable service).
5. Never suggest attack techniques, malware, or penetration tests.
6. Offer HTML/JSON export path; do not upload reports externally without user consent.
## Integrations
- `exposed-service-triage`
- `mcp-tool-scout`
- `hitl-approver`
## Error Handling
| Failure | Response |
|---------|----------|
| Tool not installed | pip install defensive-mcp-audit[cli] or clone github.com/Stijnman/defensive-mcp-audit. |
| Permission denied on ss | Report limitation; suggest user-run with adequate permissions. |
## Gotchas
- Defensive only — inspection, not exploitation.
## Safety & Ethics (Publication-Ready)
This skill is designed for public distribution. Constraints:
- Read-only inspection; no network attacks or exploitation.
- Reports stay local unless user explicitly requests upload.
- Remediation advice is configuration-only (bind, disable, firewall).
### Prohibited actions
- No unauthorized access, malware, or harmful automation
- No silent exfiltration of data, credentials, or telemetry
- No destructive system changes without hitl-approver
- No publication of user PII or environment secrets in outputs
### Attribution
- Wraps the MIT-licensed defensive-mcp-audit project by Stijnman.
## Example
**Input:** User request matching triggers above.
**Output:** Structured result per workflow; local artifacts only unless user opts in.