MCP Security Audit MCP Server

Most developer tooling work still happens through a UI a human drives. MCP Security Audit MCP server moves it into the conversation instead. Audit your package.json dependencies.

The short version

A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security checks.

• 🔍 Real-time security vulnerability scanning
• 🚀 Remote npm registry integration
• 📊 Detailed vulnerability reports with severity levels
• 🛡️ Support for multiple severity levels (critical, high, moderate, low)
• 📦 Compatible with npm/pnpm/yarn package managers
• 🔄 Automatic fix recommendations

Getting it running

The server ships on npm as @smithery/cli, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

How it compares

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. It is maintained by qianniuspace; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.