secure-mcp
Defensive, agent-first security audits over MCP: scope repositories, route stack-aware guidance, and produce structured remediation findings.
read-only by design stdio transportSecurity review that agents can carry forward
secure-mcp gives coding agents a small, structured toolkit for defensive code review. It inventories a repository, detects its stack, loads only the knowledge packs it needs, and turns likely weaknesses into remediation-ready findings.
The server is intentionally local. It reads files under an approved project_root, never executes the target project, and keeps stdout reserved for MCP JSON-RPC.
Install and connect
Build the server, authorize local repository roots, and connect it to Claude, Cursor, Codex, or another stdio client.
Run the audit workflow
Follow the multi-phase sequence from inventory to confirmed findings and a human-facing remediation plan.
Explore the tool surface
See what each tool reads, returns, and contributes to the final report.
Host these docs
Build and verify the Blume site in GitHub Actions, then publish it through a separate Cloudflare Pages or Workers configuration.
The operating model
Scope first
Start with project structure and architecture so scans stay bounded and stack-aware.
Remediate clearly
Every finding carries evidence, classification, impact, remediation, residual risk, and verification.
Verify before reporting
Heuristics are candidates. Agents confirm data flow before treating a signal as a finding.
What it covers today
| Surface | Coverage |
|---|---|
| Web | TypeScript, Next.js App Router, API handlers, cookies, CSRF, and NEXT_PUBLIC_ exposure |
| Apple platforms | Swift, SwiftUI, Keychain, ATS, WebView bridges, deep links, and macOS controls |
| React Native | Expo config, SecureStore, OTA boundaries, deep links, and token storage |
| Cross-cutting | Authentication, injection risks, secrets, threat modeling, and report rollup |
Read the design notes
Understand the process boundaries, filesystem policy, progressive knowledge packs, and extension points.