Audit MCP Cli MCP Server

Lightweight dependency vulnerability audit tool with CLI and MCP Server support. The audit mcp cli mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 1 defined tool rather than through you.

What it actually does

A lightweight dependency vulnerability audit tool for Node.js projects. Supports CLI and MCP Server modes, covers npm and pnpm projects, and generates structured Markdown/HTML reports with full dependency chains.

• Full dependency chains — — traces the complete path from your package.json to each vulnerable package
• npm + pnpm support — — auto-detects package manager by lockfile
• Remote GitHub audit — — audit any public or private repo without cloning
• MCP Server — — integrates with AI coding assistants (Claude, Cursor, etc.)
• Markdown / HTML reports — — clean, structured reports sorted by severity
• CI gate — — --fail-on exit code for CI/CD pipelines

Its toolset

Everything the assistant can do here goes through one of these:

• Cursor — The Cursor tool exposed by this server

Configuration

You will need one environment variable: GITHUB_TOKEN. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Adding it to your client

The server ships on npm as audit-mcp-cli, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

When to reach for it

Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Audit MCP Cli's toolset — Cursor — is a fair guide to whether it matches your workflow. It is maintained by double527; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Audit MCP Cli's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.

Caveats

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the audit mcp cli mcp server does with a few real requests.