# io.github.michalper/mcp-magento-audit (pypi · mcp-magento-audit)

MCP server for auditing Magento projects: update compatibility, module quality, dependency security

- Trust score: 65/100 (medium)
- Change this week: −15
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- pypi · `mcp-magento-audit`: 65/100 (this document), [markdown](https://verifymcp.io/servers/michalper-mcp-magento-audit/mcp-magento-audit.md), [page](https://verifymcp.io/servers/michalper-mcp-magento-audit/mcp-magento-audit)

## Channel facts

- Registry: `pypi`
- Package: `mcp-magento-audit`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 1 of 28 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to michalper/mcp-magento-audit).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 17 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1748 tokens (~218/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability check failed: the tool surface changed between 0.3.0 and 0.4.0: 6 tool removals, 0 breaking changes, 6 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the io.github.michalper/mcp-magento-audit server?

io.github.michalper/mcp-magento-audit runs locally as a PyPI package, launched with uvx mcp-magento-audit. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add michalper-mcp-magento-audit -- uvx mcp-magento-audit
```

### Cursor

```json
{
  "mcpServers": {
    "michalper-mcp-magento-audit": {
      "command": "uvx",
      "args": [
        "mcp-magento-audit"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "michalper-mcp-magento-audit": {
      "command": "uvx",
      "args": [
        "mcp-magento-audit"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add michalper-mcp-magento-audit -- uvx mcp-magento-audit
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "michalper-mcp-magento-audit": {
      "type": "local",
      "command": [
        "uvx",
        "mcp-magento-audit"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add michalper-mcp-magento-audit --command uvx --arg mcp-magento-audit
```

### Hermes

```yaml
mcp_servers:
  michalper-mcp-magento-audit:
    command: "uvx"
    args: ["mcp-magento-audit"]
```

### Netclaw

```json
{
  "McpServers": {
    "michalper-mcp-magento-audit": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "mcp-magento-audit"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add michalper-mcp-magento-audit -t stdio -c uvx -a mcp-magento-audit
```

### Other

```json
{
  "mcpServers": {
    "michalper-mcp-magento-audit": {
      "command": "uvx",
      "args": [
        "mcp-magento-audit"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 65, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-31 (score 80, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-30 (score 65, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-22 (score 80, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-18 (score 65, +4)

- [security regression] Stability: unverified → fail
- [functional regression] Schema quality: 187 → 218
- [functional improvement] Tool coverage: 0% → 100%
- [functional] Schema quality: good → excellent
- [functional] Package version: 0.3.0 → 0.4.0

### 2026-10-17 (score 61)

First indexed and scored.

## MCP tools (8)

### `get_project_status` (~93 tokens)

Reads composer.json and composer.lock of the given Magento project and returns its state: Magento version, PHP requirement, package count and the list of packages abandoned by their authors. Call this first for a fast, composer-only overview before the deeper (and slower) checks like check_updates, scan_module_risk or build_upgrade_plan.

Input parameters:

- `path` (string, required): Filesystem path to the Magento project root (holds composer.json).

### `check_updates` (~194 tokens)

Checks the given Magento project against a target PHP and Magento version, with two independent signals: a per-package verdict ('ok', 'blocks' or 'unknown') from declared composer.lock PHP requirements, and code_compatibility — whether the project's own code would actually need changes under the target PHP, via a Rector dry-run (declared requirements are often just '*', which alone gives a false sense of readiness). The PHP requirement for the target Magento version comes from a local cache, a live fetch, or an offline fallback table, in that order — the result says which one was used.

Input parameters:

- `path` (string, required): Filesystem path to the Magento project root (holds composer.json).
- `target_magento` (string, required): Target Magento version to check compatibility against, e.g. "2.4.7".
- `target_php` (string, required): Target PHP version to check compatibility against, e.g. "8.3".

### `scan_module_risk` (~539 tokens)

Scans the given Magento project's custom code for coding-standard violations, static-analysis issues and dead-code/quality suggestions by shelling out to the project's own vendor/bin/phpcs, vendor/bin/phpstan and vendor/bin/rector. phpcs: if the project has its own phpcs.xml(.dist), that configuration is used as-is; otherwise falls back to the Magento2 standard on app/code. phpstan and rector: only run if the project has its own phpstan.neon(.dist)/rector.php — unlike phpcs there is no safe generic fallback (no paths/level/extensions/rule sets to guess), so they're skipped rather than guessing. rector's findings are reported as severity=warning (suggestions, not pass/fail violations). A fourth, separate check (vendor_phpcs) scans third-party vendor/ Magento modules (type magento2-module in composer.lock, excluding magento/* core) with the bare Magento2 standard — the scanned package list is in vendor_packages, and those issues carry scope='vendor' (vs 'app_code' for the rest) so callers can tell code they can fix from code they can't. A fifth check (object_manager_misuse) is a plain regex scan over app/code's own .php/.phtml files for ObjectManager::getInstance() — not a phpcs sniff: magento-coding-standard's only built-in check for this fires solely inside .phtml templates, not in Model/Block/Helper classes where bypassing constructor DI is arguably more harmful. A sixth check (core_overrides) flags app/code classes that redeclare a class already present in vendor/magento/* under the exact same fully qualified name (a copy-pasted core file, not a legitimate di.xml preference/plugin) — severity=error, so unlike the previous two it does become a build_upgrade_plan blocker, since that silently blocks safely updating the vendor copy it shadows. A seventh check (dangling_references) flags app/code's own di.xml (preference/plugin), events.xml (observer), crontab.xml (job), layout XML (block/uiComponent), indexer.xml and schema.graphqls (@resolver) naming a PHP class tha…

Input parameters:

- `path` (string, required): Filesystem path to the Magento project root (holds composer.json).

### `audit_security` (~98 tokens)

Checks every installed package in the given Magento project's composer.lock — core Magento, third-party vendor/ extensions, dev dependencies, not just custom app/code — against known security advisories via `composer audit`. Returns scanned=false with a reason (e.g. no composer.lock, composer not found) rather than silently reporting zero advisories when the check never ran.

Input parameters:

- `path` (string, required): Filesystem path to the Magento project root (holds composer.json).

### `check_outdated_packages` (~153 tokens)

Checks every installed package in the given Magento project's composer.lock against `composer outdated` to report which ones have a newer version available — independent of audit_security (known CVEs) and check_updates (compatibility with a target PHP/Magento version): a package can be behind on releases with neither of those issues, and that's still tech debt worth surfacing. Each package's own latest-status (e.g. semver-safe-update vs update-possible) is included as reported by Composer. Returns scanned=false with a reason (e.g. no composer.lock, composer not found) rather than silently reporting zero outdated packages.

Input parameters:

- `path` (string, required): Filesystem path to the Magento project root (holds composer.json).

### `fetch_release_notes` (~89 tokens)

Fetches Magento's own release notes for a given version from the magento/magento2 GitHub repo's Releases API — never reconstructs them from training data. Returns found=false with a reason when nothing could be fetched, rather than guessing what a release might have contained.

Input parameters:

- `version` (string, required): Magento version to fetch release notes for, e.g. "2.4.7".

### `build_upgrade_plan` (~284 tokens)

Builds an upgrade plan for the given Magento project against a target PHP and Magento version by combining check_updates, scan_module_risk, audit_security, check_outdated_packages and fetch_release_notes. The verdict is a list of concrete blockers (composer constraints, code that Rector flags as needing changes, phpcs/phpstan errors in the project's own app/code, security advisories against installed packages), each with its own reason — not a single abstract score. check_outdated_packages and vendor/-scope scan_module_risk issues are informational only (included in the full result, not in blockers): being behind on releases, or a third-party module's own code quality, don't block *this* upgrade the way an app/code error or a composer constraint does. ready=true only when the blockers list is empty, but check 'unverified' too: it lists any signal that couldn't run at all (e.g. phpstan/rector not installed, or composer missing for audit_security/check_outdated_packages), which ready=true does not account for.

Input parameters:

- `path` (string, required): Filesystem path to the Magento project root (holds composer.json).
- `target_magento` (string, required): Target Magento version to check compatibility against, e.g. "2.4.7".
- `target_php` (string, required): Target PHP version to check compatibility against, e.g. "8.3".

### `build_fleet_overview` (~249 tokens)

Triages many Magento projects at once against a target PHP/Magento version — 'which of these N stores can be upgraded today'. Runs only check_updates per project (composer-constraint verdicts, plus code_compatibility if the project has its own rector.php) — deliberately not the full build_upgrade_plan, since scan_module_risk's phpcs/phpstan/rector and audit_security's/check_outdated_packages' composer calls are each seconds-to-minutes and don't scale across a whole fleet in one call. A project reported blocked=false here can still have scan_module_risk/audit_security findings that build_upgrade_plan would catch — call build_upgrade_plan per project afterward for the full picture. A project that fails to load (bad path, missing composer files) is reported with its own error instead of failing the whole batch.

Input parameters:

- `paths` (array, required): Filesystem paths to the Magento project roots to triage, one per project.
- `target_magento` (string, required): Target Magento version to check compatibility against, e.g. "2.4.7".
- `target_php` (string, required): Target PHP version to check compatibility against, e.g. "8.3".

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/michalper-mcp-magento-audit/mcp-magento-audit#diagnostics

## Score history

- 2026-11-04: 65
- 2026-11-03: 65
- 2026-11-02: 80
- 2026-11-01: 80
- 2026-10-31: 80
- 2026-10-30: 65
- 2026-10-29: 80
- 2026-10-28: 80
- 2026-10-27: 80
- 2026-10-26: 80
- 2026-10-25: 80
- 2026-10-24: 80
- 2026-10-23: 80
- 2026-10-22: 80
- 2026-10-21: 65
- 2026-10-20: 65
- 2026-10-19: 65
- 2026-10-18: 65
- 2026-10-17: 61

## Common questions

### What is the io.github.michalper/mcp-magento-audit server?

io.github.michalper/mcp-magento-audit is listed in the public MCP registry as io.github.michalper/mcp-magento-audit. MCP server for auditing Magento projects: update compatibility, module quality, dependency security. This page covers its PyPI package (mcp-magento-audit).

### Is the io.github.michalper/mcp-magento-audit server safe to use?

io.github.michalper/mcp-magento-audit scores 65 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.michalper/mcp-magento-audit server expose?

io.github.michalper/mcp-magento-audit exposes 8 tools: get_project_status, check_updates, scan_module_risk, audit_security, check_outdated_packages, and 3 more. Their descriptions and schemas cost roughly 1,699 tokens of context every time the server is loaded.

### Is the io.github.michalper/mcp-magento-audit server still maintained?

io.github.michalper/mcp-magento-audit is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.michalper/mcp-magento-audit server under?

io.github.michalper/mcp-magento-audit declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/mcp-magento-audit/
- Socket report: https://socket.dev/pypi/package/mcp-magento-audit
- Repository: https://github.com/michalper/mcp-magento-audit
- Changelog RSS feed: https://verifymcp.io/servers/michalper-mcp-magento-audit/mcp-magento-audit.xml
- Changelog JSON feed: https://verifymcp.io/servers/michalper-mcp-magento-audit/mcp-magento-audit.json
- HTML version of this page: https://verifymcp.io/servers/michalper-mcp-magento-audit/mcp-magento-audit