MCP for Claude Code and Cursor

The MCP server (@auditai/mcp, binary auditai-mcp, stdio) mirrors the CLI one tool at a time. There is no arbitrary-shell tool — every tool takes a project path and, where relevant, a finding id.

Set up

The MCP server isn't a published npm package yet — a one-line npx auditai-mcp install with no source checkout is coming. Today you build it from a checkout of the Audit AI source, once, from the repo root:

npm ci
npm run build   # builds packages/mcp/dist/bin.js

If you're working inside that repository in Claude Code, you can stop there: .mcp.json at the root already points at packages/mcp/dist/bin.js, and Claude Code picks it up automatically once the build exists.

To point it at a different project, register it explicitly. Run this from the Audit AI repo root so the path resolves to an absolute one:

Claude Code

claude mcp add auditai \
  -e ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY \
  -- node "$(pwd)/packages/mcp/dist/bin.js"

Cursor

Settings → MCP → Add server. Command node, args ["/absolute/path/to/audit-ai/packages/mcp/dist/bin.js"], env ANTHROPIC_API_KEY.

ANTHROPIC_API_KEY is only needed for the two hosted-reasoning tools (audit_explain_finding, audit_generate_fix). Agent mode, below, needs nothing — you're already paying for the model inside Claude Code or Cursor. Stuck setting it up? Write to hello@auditai.sh.

Tools

Tool	What it does	Needs
`audit_scan`	Deterministic project scan, saves .audit/scan.json	nothing
`audit_get_findings`	Findings from the last scan, with reasoning/fix/verification state, as JSON	nothing
`audit_explain_finding`	Hosted reasoning model decides whether the finding is real: confirmed / suppressed / unverified	`ANTHROPIC_API_KEY`
`audit_generate_fix`	Minimal patch + regression test; writes to the project only when apply=true	`ANTHROPIC_API_KEY`
`audit_verify_finding`	Runs the before/after sandbox protocol, returns the proof	`Docker, Supabase CLI`
`audit_get_context`	Agent mode: hands your agent the same instructions, code slice, policies and response schema a hosted model would get, for the reason or fix stage	nothing
`audit_record_verdict`	Agent mode: takes your agent's verdict, applies the same thresholds and state transitions as a hosted call	nothing
`audit_propose_fix`	Agent mode: checks your agent's patch (each search string exactly once, nothing outside the project root), saves diff + test; writes only when apply=true	nothing
`audit_get_proof`	The saved proof for a finding	nothing
`audit_doctor`	Self-diagnostic	nothing

Agent mode: your model reasons, Audit AI judges

If you're already in Claude Code or Cursor, you're already paying for a model — Audit AI doesn't need its own key. Your agent calls audit_get_context for the reason stage, gets the exact instructions and the same bounded, explicitly-untrusted code slice a hosted call would get, reasons about it itself, and reports a verdict through audit_record_verdict. That verdict goes through the same thresholds and state machine as a hosted verdict: confirmed at confidence ≥ 0.75, suppressed at ≥ 0.7 confidence "not vulnerable", otherwise unverified.

For a confirmed finding, the agent asks for audit_get_context with the fix stage, writes a minimal patch plus a DENY/ALLOW regression test, and hands them to audit_propose_fix — which validates the patch against the real files before anything happens and never writes to your project unless you pass apply=true. From there audit_verify_finding proves the fix in the sandbox exactly like any other path (/docs/verification). The finding's model field records agent:<name>, cost 0.

What stays with Audit AI in this mode: the deterministic search, the untrusted-content boundary around everything the agent reads, the confirmation/suppression thresholds, checking the patch matches exactly once and never leaves the project root, and the sandbox proof. What goes to the agent: the quality of the reasoning and the patch. The trade is honest — the proof is still ours either way.

A typical dialogue

Scan this project with audit_scan. For each finding, pull its context with
audit_get_context, decide whether it is real, and record your verdict. For anything
confirmed, propose a patch with audit_propose_fix — don't apply it. Then prove
AUDIT-001 with audit_verify_finding.

Boundaries

Path arguments must resolve inside the directory the server was started in — full detail and the opt-out env var on /docs/security. Repository content reaching a model, hosted or your own agent's, is always labeled untrusted; a comment inside the scanned repo telling the agent to skip a check or exfiltrate something is just a string, not an instruction.