New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

MCP Audit

by hoangsonww in hoangsonww/Claude-Code-Agent-Monitor

Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each…

MITAuto-check passedAgent Workflows

Install MCP Audit

skills CLI
$ npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install hoangsonww/Claude-Code-Agent-Monitor mcp-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-Monitor.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ccam-config/skills/mcp-audit .claude/skills/mcp-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
mcp-audit
GitHub stars
1.1k
Token cost
~700 tokens
SKILL.md length
327 words
Files
2
Skills in repo
78
Repo updated
First seen
Licence
MIT

At a glance

Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each…

  • Works in 3 steps: Server inventory → Scope split & duplication → Hygiene flags
  • Reviewing MCP integrations for hygiene
  • SKILL.md covers Input, Data Sources, Report Sections and Output
  • Calls kind and npm

What it does

MCP Audit is an agent skill from hoangsonww/Claude-Code-Agent-Monitor. Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each definition came from. Reads /api/cc-config/mcp. Use when reviewing MCP integrations for hygiene, duplication, or unexpected transports.

Its SKILL.md is about 700 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `agents/openai.yaml`).

It sits in Agent Workflows, covering MCP servers. It works with Model Context Protocol. The repository describes itself as: 🚀 A real-time monitoring dashboard for Claude Code & Codex, built with SQLite3, Node.js, Express, React, Vite, TailwindCSS, & WebSockets. It tracks sessions, agent activity… The licence is MIT.

When your agent uses it

  • Reviewing MCP integrations for hygiene
  • Unexpected transports

Example prompts

  • “/mcp-audit”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Server inventory
  2. Scope split & duplication
  3. Hygiene flags

What it can do on your machine

Read from SKILL.md and the folder at commit a06db03. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • kind
    • npm

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

MCP Audit loads about 700 tokens when it runs. Until then it costs about 86 tokens; SKILL.md has 327 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~86
When it runs · the whole SKILL.md, loaded when a task matches
~700

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from hoangsonww/Claude-Code-Agent-Monitor at commit a06db03, republished under its MIT licence (© hoangsonww). 327 words, ~700 tokens.

Download SKILL.mdSave it as .claude/skills/mcp-audit/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
mcp-audit
description
Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each definition came from. Reads /api/cc-config/mcp. Use when reviewing MCP integrations for hygiene, duplication, or unexpected transports.

MCP Audit

Inventory and audit every Model Context Protocol server the user has configured — both user-scope and project-scope — read through the Agent Monitor dashboard at http://localhost:4820.

Input

The user provides: $ARGUMENTS

This may be:

  • empty — audit all MCP servers (default).
  • a server name fragment — focus on matching servers.
  • "stdio" / "http" — restrict to one transport kind.

Data Sources

EndpointReturns
GET /api/cc-config/mcp{ user:[…], projectScoped:[…] }. Each server: { name, source, kind } where kind is stdio (with command, args, envNames), http (with url, headers), or unknown. source names the file the definition came from (e.g. ~/.claude.json (top-level), ~/.claude.json (projects[<root>]), ~/.claude/settings.json)

Report Sections

1. Server inventory

List every server from user and projectScoped. For each show name, source, kind, and the transport detail:

  • stdio — the command, its args, and the envNames (names only — values are not exposed by the API).
  • http — the url and the headers key names (values not exposed).
  • unknown — a definition the server could not classify; flag it for review.
2. Scope split & duplication

Separate user-scope from project-scope servers. Flag any name that appears in both scopes (project may shadow user) and any duplicate definitions across source files.

3. Hygiene flags
  • Unknown transport — servers with kind: "unknown" (malformed or unsupported definition).
  • Env reliance — stdio servers with many envNames; note they depend on environment variables being present at launch.
  • Remote endpoints — http servers; surface the url host so the user can confirm they trust the remote.

Output

  • Section 1 as a table (Scope | Name | Kind | Transport detail | Source).
  • Env names and header names listed by name only — never invent or print values (the API does not expose them).
  • Cite only fields the API returned — never fabricate servers, commands, or hosts.
  • Note: MCP servers are read-only via the Config Explorer (they are written concurrently by the running CLI); edit their definitions in the source file named by source.
  • If the dashboard is unreachable at http://localhost:4820, say so and tell the user to start it with npm start from the repo root.

© hoangsonww, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in plugins/ccam-config/skills/mcp-audit of hoangsonww/Claude-Code-Agent-Monitor.

  • SKILL.md
  • agents/openai.yaml

Open the folder on GitHubat commit a06db03

Compare with similar skills

MCP Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

MCP Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
MCP Audit this skillhoangsonww/Claude-Code-Agent-Monitor1.1k—~700Automated safety check: PassMIT
MCP Server Builderanthropics/skills180k63 repos~2.3kAutomated safety check: PassApache-2.0
MCP Server BuildershareAI-lab/learn-claude-code78k4 repos~1.2kAutomated safety check: PassMIT
MCP Integration for Pluginsanthropics/claude-plugins-official38k11 repos~3.1kAutomated safety check: PassApache-2.0
Crush Configurationcharmbracelet/crush29k—~3.7kAutomated safety check: PassCustom licence
Context Mode Output Sandboxmksglu/context-mode26k—~4.1kAutomated safety check: PassCustom licence

Similar skills

  • MCP Server Builder

    anthropics/skills

    Official

    Guides the design and implementation of Model Context Protocol servers in TypeScript or Python, from tool naming and error messages to evaluation.

    180k GitHub starsUsed in 63 repos~2.3k tokens
    Agent WorkflowsAuto-check passed

  • MCP Server Builder

    shareAI-lab/learn-claude-code

    Walks through building MCP servers in Python or TypeScript that expose tools, resources and prompts to Claude, with templates, registration and testing.

    78k GitHub starsUsed in 4 repos~1.2k tokens
    Agent WorkflowsAuto-check passed

  • MCP Integration for Plugins

    anthropics/claude-plugins-official

    Official

    Explains how to bundle Model Context Protocol servers in a Claude Code plugin, covering config files, stdio, SSE, HTTP and WebSocket server types, and authentication.

    38k GitHub starsUsed in 11 repos~3.1k tokens
    Agent WorkflowsAuto-check passed

  • Crush Configuration

    charmbracelet/crush

    Explains how to configure the Crush coding agent with crushrc or crush.json, covering providers, models, LSPs, MCP servers, hooks, permissions and config precedence.

    29k GitHub stars~3.7k tokensUpdated today
    Agent WorkflowsAuto-check passed

  • Context Mode Output Sandbox

    mksglu/context-mode

    Routes large command, file, API and browser output through context-mode tools so only the needed result enters the agent's context, instead of dumping it via Bash.

    26k GitHub stars~4.1k tokensUpdated today
    Agent WorkflowsAuto-check passed

  • Warp GUI to Agent CLI Migration

    warpdotdev/warp

    Migrates the compatible subset of settings and global file-based MCP servers from the Warp desktop app into Warp Agent CLI without exposing credentials or state.

    65k GitHub starsUsed in 1 repo~2.1k tokens
    Agent WorkflowsAuto-check passed

More from hoangsonww/Claude-Code-Agent-Monitor

All 78 skills in this repo

  • Version Release

    hoangsonww/Claude-Code-Agent-Monitor

    Choose and apply the correct semantic version bump for this repository.

    1.1k GitHub stars~1.6k tokensUpdated today
    Auto-check passed

  • Budget Set

    hoangsonww/Claude-Code-Agent-Monitor

    Define a spend budget for Claude Code and, optionally, create a cost alert rule that fires when usage crosses the limit, via POST /api/alerts/rules on the Agent Monitor dashboard.

    1.1k GitHub stars~1k tokensUpdated today
    Auto-check passed

  • Cache Efficiency

    hoangsonww/Claude-Code-Agent-Monitor

    Analyze prompt-cache effectiveness for Claude Code usage from the Agent Monitor dashboard — cache hit rate (totalcacheread / (totalcacheread + totalinput)), cachewrite vs cacheread reuse, cache-read…

    1.1k GitHub stars~966 tokensUpdated today
    Auto-check passed

  • Cost Breakdown

    hoangsonww/Claude-Code-Agent-Monitor

    Break down Claude Code costs using the Agent Monitor pricing engine.

    1.1k GitHub stars~845 tokensUpdated today
    Auto-check passed

  • Dag Map

    hoangsonww/Claude-Code-Agent-Monitor

    Render the multi-agent orchestration DAG for a session — parent→child subagent edges, tree depth, and fan-out — from the Agent Monitor workflow intelligence API.

    1.1k GitHub stars~564 tokensUpdated today
    Auto-check passed

  • Dashboard Status

    hoangsonww/Claude-Code-Agent-Monitor

    Quick dashboard health and status overview — checks the Agent Monitor API (port 4820), reports session/agent/event counts from /api/stats, confirms WebSocket connectivity, reads the redacted hook…

    1.1k GitHub stars~600 tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about MCP Audit

What does MCP Audit do?

Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each…. MCP Audit is an agent skill from hoangsonww/Claude-Code-Agent-Monitor. Audit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each definition came from.

When should I use MCP Audit?

MCP Audit fits situations like: reviewing MCP integrations for hygiene; unexpected transports.

How do I install MCP Audit in Claude Code?

Run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -a claude-code`. Or copy the skill folder (plugins/ccam-config/skills/mcp-audit in hoangsonww/Claude-Code-Agent-Monitor) into .claude/skills/mcp-audit in your project. Claude Code loads it when a task matches its description.

How do I install MCP Audit in Codex?

Run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -a codex`. Or copy the skill folder (plugins/ccam-config/skills/mcp-audit in hoangsonww/Claude-Code-Agent-Monitor) into .agents/skills/mcp-audit in your project. Codex loads it when a task matches its description.

Can I use MCP Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill mcp-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/mcp-audit, .gemini/skills/mcp-audit, .github/skills/mcp-audit and .opencode/skills/mcp-audit in your project.

What does MCP Audit need to run?

Going by SKILL.md and its folder, MCP Audit needs the command-line tools its instructions call (kind and npm).

Does MCP Audit access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is MCP Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does MCP Audit use?

MCP Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does MCP Audit use?

About 700 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to MCP Audit?

Skills that share tags, products or a category with MCP Audit: MCP Server Builder (anthropics/skills, 180k stars), MCP Server Builder (shareAI-lab/learn-claude-code, 78k stars), MCP Integration for Plugins (anthropics/claude-plugins-official, 38k stars) and Crush Configuration (charmbracelet/crush, 29k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains MCP Audit?

hoangsonww (a GitHub user) maintains it in hoangsonww/Claude-Code-Agent-Monitor, which has 1,058 GitHub stars. The repository holds 78 skills in this directory. The repository was last updated on October 10, 2026.

Source: hoangsonww/Claude-Code-Agent-Monitor on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.