SERVICE

mcp-audit

Xynaptic MCP Audit — static security review of an MCP client config before you approve it: paste any mcpServers config (mcp.json, Cursor, VS Code…), we classify every package reference (exact pin = SAFE, @latest/tag = HIGH, range = MEDIUM, local/VCS = REVIEW), detect mutable dependencies that can silently resolve to different code after approval, and return a per-server verdict with fixes. Pure static analysis: never executes discovered servers, never resolves packages. POST body: { config: <object or JSON string> }. Boundaries: reproducibility signal, not a breach claim.

$0.5 per call · /v1/mcp-audit

Call it

curl -s https://api.xynaptic.io/v1/mcp-audit \
  -H "Accept: application/json"

# -> 402 Payment Required (x402 challenge: price, payTo, networks)
# -> sign the payment, retry with PAYMENT-SIGNATURE -> 200

What you get back

{
  "service": "mcp-audit",
  "verdict": "NEEDS-FIX",
  "servers": 4,
  "findings": [
    {
      "server": "browser",
      "reference": "example-browser-mcp@latest",
      "result": "HIGH",
      "why": "npm distribution tag is mutable",
      "next": "pin the exact version the team reviewed"
    },
    {
      "server": "pinned",
      "reference": "xynaptic-mcp@1.1.8",
      "result": "SAFE",
      "why": "exact pin"
    }
  ],
  "disclaimer": "Static review only — no server executed."
}