How We Built an Automated MCP Security Scanner (And What We Found)

AI agents are executing code, reading files, and making API calls on your behalf every day. The tools they use — MCP servers — are the new attack surface nobody is talking about. Here's how we built a scanner to audit them automatically. The Problem We Set Out to Solve When you install an MCP server, you're giving an AI agent a new capability. That server might read your filesystem, execute shell commands, or call external APIs. But who audited that code before it ran on your machine? Nobody. Until now. At AgentAudit , we built an automated multi-agent pipeline that audits MCP servers, npm packages, pip packages, and AgentSkills — and flags security risks before your agent ever touches them. The Architecture Our audit pipeline runs three specialized sub-agents in parallel, each with a different security lens: Agent 1: Static Analysis Scans the source code for known vulnerability patterns: Unsanitized shell command injection ( child_process.exec with user input) Hardcoded credentials an