@auditormcp/mcp

Auditor CLI + MCP for security audits based on your project's actual stack.

Instead of generic checklists, it detects your stack (Node/Python + frameworks), creates auditor.json, and fetches security rules that match your context.

Install

npm install -g @auditormcp/mcp

Requirement: Node.js 18+

Quick start

Inside the project you want to audit:

npx -y -p @auditormcp/mcp auditor

This opens the interactive menu (login, sync, and audit flow).
If you prefer direct commands:

auditor login
auditor init
auditor audit

Main commands

• auditor -> open interactive menu
• auditor init -> detect stack and create auditor.json
• auditor update -> refresh auditor.json only if fingerprint changed
• auditor print -> show current stack/fingerprint
• auditor audit -> update stack and print audit prompt guidance
• auditor install --client <claude|cursor|windsurf> [--local] -> configure MCP for your AI client

Landing-page install examples:

npx -y -p @auditormcp/mcp auditor install --client claude
npx -y -p @auditormcp/mcp auditor install --client cursor
npx -y -p @auditormcp/mcp auditor install --client windsurf

Use the explicit auditor bin with npx. The package also ships an MCP server entrypoint, so npx @auditormcp/mcp ... can resolve to the wrong executable.

MCP (for AI clients)

This package also installs:

• auditor-mcp
• mcp (alias)

Main tool: get_project_security_rules
It auto-detects the current project and returns rules ordered by severity.

Optional config

Environment variables:

• AUDITOR_API_URL (default: https://auditor-backend-o9xw.onrender.com)
• AUDITOR_API_KEY (auth token)

You can also use local files in ~/.auditor/ (config.json and auth.json).

If you want security reviews that are contextual instead of generic, this package is built for that.

Keywords: mcp, security, appsec, code audit, claude code, cursor, windsurf, model context protocol, secure coding, nodejs, python