# io.github.stackscribe-ai/coding-agent-audit (pypi · coding-agent-audit)

Audits Claude Code/Cursor MCP configs for supply-chain backdoors and risky permissions.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- pypi · `coding-agent-audit`: 68/100 (this document), [markdown](https://verifymcp.io/servers/stackscribe-ai-coding-agent-audit/coding-agent-audit.md), [page](https://verifymcp.io/servers/stackscribe-ai-coding-agent-audit/coding-agent-audit)

## Channel facts

- Registry: `pypi`
- Package: `coding-agent-audit`
- Version: `0.11.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it.
  - 1 of 28 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 815 tokens (~163/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the io.github.stackscribe-ai/coding-agent-audit MCP server?

io.github.stackscribe-ai/coding-agent-audit runs locally as a PyPI package, launched with uvx coding-agent-audit. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add stackscribe-ai-coding-agent-audit -- uvx coding-agent-audit
```

### Cursor

```json
{
  "mcpServers": {
    "stackscribe-ai-coding-agent-audit": {
      "command": "uvx",
      "args": [
        "coding-agent-audit"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "stackscribe-ai-coding-agent-audit": {
      "command": "uvx",
      "args": [
        "coding-agent-audit"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add stackscribe-ai-coding-agent-audit -- uvx coding-agent-audit
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "stackscribe-ai-coding-agent-audit": {
      "type": "local",
      "command": [
        "uvx",
        "coding-agent-audit"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add stackscribe-ai-coding-agent-audit --command uvx --arg coding-agent-audit
```

### Hermes

```yaml
mcp_servers:
  stackscribe-ai-coding-agent-audit:
    command: "uvx"
    args: ["coding-agent-audit"]
```

### Netclaw

```json
{
  "McpServers": {
    "stackscribe-ai-coding-agent-audit": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "coding-agent-audit"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add stackscribe-ai-coding-agent-audit -t stdio -c uvx -a coding-agent-audit
```

### Other

```json
{
  "mcpServers": {
    "stackscribe-ai-coding-agent-audit": {
      "command": "uvx",
      "args": [
        "coding-agent-audit"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 68, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-11-03 (score 53, 0)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Schema quality: 145 → 163
- [functional regression] Schema quality: 436 → 598
- [functional] Package version: 0.6.0 → 0.11.0
- [functional] Package version: 0.6.0 → 0.10.0
- [functional] Package version: 0.6.0 → 0.9.0
- [functional] Package version: 0.6.0 → 0.8.0
- [functional] Package version: 0.6.0 → 0.7.0
- [functional] Package version: 0.6.0 → 0.6.1

### 2026-11-02 (score 53, −14)

- [security regression] Malware scan: pass → unverified
- [functional regression] Schema quality: pass → fail
- [functional improvement] Stability: unverified → 0.07
- [functional] Package version: 0.3.2 → 0.6.0

### 2026-11-01 (score 67, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-31 (score 52)

First indexed and scored.

## MCP tools (5)

### `scan_for_known_backdoors` (~71 tokens)

Scan this machine for known, publicly-documented indicators of
compromise from AI-coding-assistant supply-chain attacks (SSH backdoor
keys, C2 processes, persistence via cron/LaunchAgent/scheduled task,
the trojanized extension.js hash). Read-only; no file is modified.

Output parameters:

- `result` (string)

### `scan_mcp_config` (~118 tokens)

Scan this machine's Claude Code / Claude Desktop / MCP config files
for risky patterns: hooks that pipe a remote download into a shell,
overly broad auto-approved permission rules (e.g. 'Bash(*)'), unpinned
MCP server packages, raw IP literals in hook commands or env vars.

Args:
    project_dir: optional path to a project whose .claude/ and
        .mcp.json should also be scanned, in addition to the user's
        home-directory config.

Input parameters:

- `project_dir`

Output parameters:

- `result` (string)

### `scan_phantom_dependencies` (~139 tokens)

Check a project's package.json / requirements.txt / pyproject.toml
dependencies against the npm/PyPI registries and flag any package name
that doesn't actually exist there. AI coding assistants occasionally
hallucinate a plausible-but-nonexistent package name; if one ends up in
a manifest, an attacker can register that exact name with malicious
code and have it silently installed on the next install
("slopsquatting"). Read-only HTTP lookups only; nothing is installed.

Args:
    project_dir: path to the project directory containing the manifest
        file(s) to check.

Input parameters:

- `project_dir` (string, required)

Output parameters:

- `result` (string)

### `scan_mcp_phantom_packages` (~217 tokens)

Check the `npx`/`uvx`/`pipx run` commands in this machine's (and
optionally a project's) MCP server config against the npm/PyPI
registries, and flag any package name that doesn't actually exist
there - the "MCPhantom" pattern (Glow Labs, Nov 2026): a coding agent
fills in a plausible-sounding MCP server name from training data, or
copies one from a long-archived tutorial whose package was since
renamed or unpublished. An attacker can register that exact name and
have it run as the MCP server, with the user's own permissions, the
next time the config is loaded. Read-only HTTP lookups only; this
never connects to or executes the MCP server itself.

Args:
    project_dir: optional path to a project whose .claude/ and
        .mcp.json should also be scanned, in addition to the user's
        home-directory config.

Input parameters:

- `project_dir`

Output parameters:

- `result` (string)

### `scan_tool_descriptions` (~162 tokens)

Scan a list of MCP tool definitions (the 'tools/list' response an
MCP server returns, e.g. [{"name": "search", "description": "..."}])
for instructions hidden in the description field - 'tool definition
injection'. A malicious or compromised MCP server can register a tool
whose description tells the LLM to also call a second,
attacker-controlled tool, or to hide an action from the user, without
ever shipping malicious code in a package. Pass another MCP server's
own tools/list output straight through; this never connects to or
executes any server itself.

Args:
    tools: list of tool definitions, each with at least a
        "description" field.

Input parameters:

- `tools` (array, required)

Output parameters:

- `result` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/stackscribe-ai-coding-agent-audit/coding-agent-audit#diagnostics

## Score history

- 2026-11-04: 68
- 2026-11-03: 53
- 2026-11-02: 53
- 2026-11-01: 67
- 2026-10-31: 52

## Common questions

### What is the io.github.stackscribe-ai/coding-agent-audit MCP server?

io.github.stackscribe-ai/coding-agent-audit is an MCP server listed in the public MCP registry as io.github.stackscribe-ai/coding-agent-audit. Audits Claude Code/Cursor MCP configs for supply-chain backdoors and risky permissions. This page covers its PyPI package (coding-agent-audit).

### Is the io.github.stackscribe-ai/coding-agent-audit MCP server safe to use?

io.github.stackscribe-ai/coding-agent-audit scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.stackscribe-ai/coding-agent-audit MCP server expose?

io.github.stackscribe-ai/coding-agent-audit exposes 5 tools: scan_for_known_backdoors, scan_mcp_config, scan_phantom_dependencies, scan_mcp_phantom_packages, scan_tool_descriptions. Their descriptions and schemas cost roughly 707 tokens of context every time the server is loaded.

### Is the io.github.stackscribe-ai/coding-agent-audit MCP server still maintained?

io.github.stackscribe-ai/coding-agent-audit is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.stackscribe-ai/coding-agent-audit MCP server under?

io.github.stackscribe-ai/coding-agent-audit declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/coding-agent-audit/
- Socket report: https://socket.dev/pypi/package/coding-agent-audit
- Repository: https://github.com/stackscribe-ai/coding-agent-audit
- Changelog RSS feed: https://verifymcp.io/servers/stackscribe-ai-coding-agent-audit/coding-agent-audit.xml
- Changelog JSON feed: https://verifymcp.io/servers/stackscribe-ai-coding-agent-audit/coding-agent-audit.json
- HTML version of this page: https://verifymcp.io/servers/stackscribe-ai-coding-agent-audit/coding-agent-audit