ClawAudit

Security gate for AI agent configs. Scans CLAUDE.md, .mcp.json, .cursorrules, and other agent config files for dangerous permissions, credential leaks, and compound threats — SARIF-native, offline, zero dependencies.

npx @clawaudit/cli scan .

What It Does

CLAUDE.md
  🔴 20/100 Dangerous  claude

  Compound Threats
    CRITICAL Reads local files AND sends data to external servers  LLM02,LLM06
             capabilities: file_read + network_out
    CRITICAL Accesses system credential store AND sends externally  LLM02
             capabilities: credential_store + network_out

  Permission Integrity
    HIGH     Makes network requests but does not declare curl/wget
    MEDIUM   Performs file operations but does not declare file-accessing binaries

  Findings
    CRITICAL Accesses AWS credentials file [prose/instruction] LLM02
    HIGH     Accesses cloud provider credentials [prose/instruction] LLM06

.mcp.json
  🔴 23/100 Dangerous  mcp

  Compound Threats
    CRITICAL Hardcoded credentials in config AND network transport  LLM02,LLM03

════════════════════════════════════════════════════════════
Cross-File Trust Trace
2 nodes, 4 edges, 9 combined capabilities
    CRITICAL [credential flow] Hardcoded credentials in MCP server
             "remote-tools" sent to remote endpoint
    HIGH     [capability escalation] CLAUDE.md does not surface
             "dangerous_command" but MCP server deployer grants it
    HIGH     [remote tool delegation] Tool responses from remote
             MCP server are not integrity-verified

Install

npx @clawaudit/cli scan .          # Run without installing
npm install -g @clawaudit/cli      # Or install globally

Requires Node.js 18+. Zero runtime dependencies.

Usage

# Scan current directory (auto-discovers config files)
clawaudit scan .

# Scan specific files
clawaudit scan CLAUDE.md .mcp.json

# Output formats
clawaudit scan . --format json
clawaudit scan . --format sarif     # GitHub Code Scanning, VS Code SARIF Viewer

# Filter by severity
clawaudit scan . --severity high    # Only show high+ findings

Exit codes: 0 clean, 1 findings detected, 2 critical/dangerous.

What It Scans

| Format | File | What | |--------|------|------| | Claude Code | CLAUDE.md | Project instructions — implicit permissions, MCP tool refs, file paths | | MCP Config | .mcp.json, claude_desktop_config.json | Server definitions, credentials, transport risks | | OpenClaw | SKILL.md | Agent skills with YAML frontmatter | | Cursor | .cursorrules | Editor rule files |

When multiple formats are found in the same directory, cross-file trust tracing connects them — detecting capability escalation, credential flows, and trust boundary violations that are invisible when scanning files individually.

Detection

Zone-Aware Analysis

Parses markdown into semantic zones (code blocks, prose, security docs, frontmatter). Pattern matches in code blocks get full severity. Matches in documentation about threats get suppressed. This kills false positives from security tutorials and "don't do this" warnings.

196 Detection Patterns

Code execution, shell injection, obfuscation, network access, credential access, filesystem operations, prompt injection, agent manipulation. Unicode confusable normalization catches homoglyph evasion.

20 Compound Threat Rules

Flags dangerous capability combinations:

• file_read + network_out = data exfiltration
• credential_access + network_out = credential theft
• network_out + dynamic_eval = remote code execution
• credential_in_config + network_out = exposed credentials
• agent_memory + network_out = memory exfiltration

Permission Integrity

Compares declared permissions against actual capabilities in code. Catches undeclared network access, credential usage, over-declared binaries, and opaque runtime dependencies.

OWASP LLM Top 10 Mapping

Every finding, compound threat, and integrity issue is mapped to OWASP Top 10 for LLM Applications (2025). SARIF output includes OWASP tags for integration with security dashboards.

Cross-File Trust Tracing

When CLAUDE.md and .mcp.json are scanned together:

• Capability escalation — MCP servers grant powers the CLAUDE.md doesn't surface
• Credential flows — traces how secrets move across config boundaries
• Remote delegation — flags non-localhost MCP servers with unverified tool responses
• Phantom tools — CLAUDE.md references MCP tools with no backing config

Output Formats

Text (default)

Human-readable terminal output with ANSI colors. Respects NO_COLOR.

JSON (--format json)

Machine-readable report with trust scores, findings, compound threats, capabilities, and trust trace.

SARIF (--format sarif)

SARIF v2.1.0 for:

• GitHub Code Scanning (upload via github/codeql-action/upload-sarif)
• VS Code SARIF Viewer extension
• Azure DevOps

Scoring

| Dimension | Weight | What | |-----------|--------|------| | Security | 50% | Pattern findings + compound threats + permission integrity | | Transparency | 25% | Trust signals, declared vs actual alignment | | Maintenance | 25% | Versioning, documentation, package structure |

Trust tiers: Trusted (80+), Caution (60-79), Risky (35-59), Dangerous (<35).

Hard caps: critical compound threats or 3+ critical findings cap the score regardless of other dimensions.

Architecture

cli.js                    CLI entry point, file discovery, output formatting
src/
  analyzer.js             Zone-aware scanner, multi-format dispatch, scoring
  zones.js                Markdown zone parser, capability extractor
  compounds.js            Compound threat detection (20 rules)
  permissions.js          Permission risk classification + integrity checking
  owasp.js                OWASP LLM Top 10 (2025) mapping
  trust.js                Cross-file trust tracing
  report.js               Report formatter, scoring, human summaries
  fetcher.js              ClawHub/GitHub skill fetcher (for API mode)
  index.js                Cloudflare Worker entry point (API mode)
  formats/
    detect.js             Auto-detection (skill/claude/mcp)
    skill.js              SKILL.md YAML frontmatter parser
    claude.js             CLAUDE.md implicit permission extractor
    mcp.js                MCP config parser, credential scanning
  output/
    sarif.js              SARIF v2.1.0 output generator

CI Integration

# .github/workflows/clawaudit.yml
name: ClawAudit
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npx @clawaudit/cli scan . --format sarif > clawaudit.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: clawaudit.sarif }
        if: always()

API

ClawAudit also runs as a hosted API on Cloudflare Workers:

# Scan a ClawHub skill by slug
curl https://api.clauwdit.4worlds.dev/audit/agentmail

# Paste raw config content
curl -X POST https://api.clauwdit.4worlds.dev/audit \
  -H 'Content-Type: application/json' \
  -d '{"content": "# My CLAUDE.md\n\nRun `curl` to fetch data...", "filename": "CLAUDE.md"}'

# One-liner format
curl https://api.clauwdit.4worlds.dev/audit/agentmail?format=oneliner

License

BSL 1.1 — free to use for scanning your own projects, CI/CD, internal use, research, and education. Converts to Apache 2.0 on 2030-03-17. See LICENSE for details.