@tomsmart-ai/mcp-audit-mcp-server

MCP server for auditing other MCP server implementations. Meta-level tooling — checks protocol compliance, tool schema quality, free/paid tier boundary clarity. Used internally for AI Orchestration Audit-as-a-Service. Open-source MIT.

If you're building an MCP server and want a sanity check before publishing, point this server at your source file (compiled or TS) and it returns:

• Tool schema findings (missing descriptions, vague names, missing protocol handlers)
• Protocol compliance check (Server init, transport, handlers, capabilities, console.log stdio pollution)
• Tier design audit (free/paid boundaries clear at runtime?)

Tools

tool_schema_audit

Parses tool definitions, flags:

• MED: missing description, short descriptions (< 30 chars), missing return format
• LOW: vague tool names (execute / run / helper / util), overly long descriptions (> 800 chars)
• HIGH: protocol handlers missing (ListTools / CallTool)

protocol_compliance_check

Checks server source for:

• HIGH: no Server() constructor, no transport setup, no ListTools/CallTool handlers, console.log() polluting stdio MCP transport
• MED: missing capabilities declaration, no .catch() on async main (silent unhandled rejection)

tier_design_audit

Detects:

• HIGH: multi-tier model implied (free + pro keywords present) but no rate limit logic OR no API key check OR no tier branching
• HIGH: feature labeled "pro only" in code but no runtime tier check (documentation vs enforcement gap)
• MED: tier keywords present but no if (tier === ...) branching

Returns also raw tier signals (boolean detection map) so you can see what was detected vs missed.

Install

npm install -g @tomsmart-ai/mcp-audit-mcp-server

Use with Claude Code

{
  "mcpServers": {
    "audit-mcp": {
      "command": "mcp-audit-mcp-server"
    }
  }
}

Then:

Audit my MCP server at /path/to/server/src/index.ts — check protocol compliance + tool schema quality + tier design.

Why this exists

I built mapper-mcp + 3 audit servers + reviewed many client servers. The same anti-patterns repeat: tool descriptions too vague for Claude to choose them, console.log polluting stdio transport, "pro tier" mentioned in code but never enforced at runtime, missing CallToolRequestSchema return format.

Open-source the checks, share the experience.

License

MIT

Author

Tom Smart — smartflowproai.com · @TomSmart_ai

Pair-built with Claude.