MCP for Claude Code and Cursor

auditai-mcp on npm is a stdio MCP server with five tools. The scan is deterministic and runs on your machine; the reasoning is done by the model you already use. No API key, no account, no Docker, nothing sent over the network. There is no shell tool: every tool takes a project path and, where relevant, a finding id.

Set up

Claude Code, from your project directory

claude mcp add auditai -- npx -y auditai-mcp

Cursor

Settings → MCP → Add server. Command npx, args ["-y", "auditai-mcp"].

Needs Node.js 22 or newer. Then ask your agent to scan the project with Audit AI and check what it finds. Stuck? Write to hello@auditai.sh.

Tools

Tool	What it does
`audit_scan`	Deterministic scan of routes, server actions, Supabase clients and queries, RLS policies. Saves .audit/scan.json
`audit_get_findings`	Findings from the last scan with any recorded verdicts and proposed fixes, as JSON
`audit_get_context`	The bounded code slice, policies and instructions for one finding, for your agent to reason about (reason) or fix (fix)
`audit_record_verdict`	Records your agent's verdict with fixed thresholds: confirmed at confidence ≥ 0.75, suppressed at ≥ 0.7 not vulnerable, otherwise unverified
`audit_propose_fix`	Checks your agent's patch (each search string exactly once, nothing outside the project), saves the diff and a regression test; writes to the project only with apply=true

Your model reasons, Audit AI judges

Your agent calls audit_get_context for the reason stage and gets the exact instructions and a bounded, explicitly untrusted code slice for one finding. It reasons about it itself and reports a verdict through audit_record_verdict, which applies fixed thresholds: confirmed at confidence ≥ 0.75, suppressed at ≥ 0.7 confidence "not vulnerable", otherwise unverified. The finding records the model as agent:<name>.

For a confirmed finding, the agent asks for audit_get_context with the fix stage, writes a minimal patch plus a DENY/ALLOW regression test, and hands them to audit_propose_fix. It checks the patch against the real files before anything happens and never writes to your project unless you pass apply=true.

An agent's verdict is not proof. To prove a hole and check the fix, push the repository to GitHub, scan it on auditai.sh and press Prove it on the finding: the sandbox runs the attack before and after the fix (/docs/verification).

A typical request

Scan this project with audit_scan. For each finding, pull its context with
audit_get_context, decide whether it is real, and record your verdict. For anything
confirmed, propose a patch with audit_propose_fix. Don't apply it.

Boundaries

Path arguments must resolve inside the directory the server was started in, symlinks included; set AUDITAI_MCP_ALLOW_ANY_PATH=1 to allow other directories. Details on /docs/security. Repository content reaching your agent is always labeled untrusted: a comment inside the scanned repo telling the agent to skip a check or send something somewhere is just a string, not an instruction. Secret files (.env, keys, credentials) are never put into the context.