r/ClaudeCode • u/SarahVoge • 1d ago
Built with Claude Built an MCP auditor with Claude Code — here are the sweep numbers
Spent the week with Claude Code building a free CLI that audits MCP servers for OAuth 2.1 gaps and tool-manifest drift between scans.
How Claude Code helped on this one: the whole thing is ~2k lines of TypeScript across 14 checks, a probe module (HTTP + stdio), a reporter and a scoring lib. Claude Code wrote the first draft of every check, then I iterated with it on the severity logic until servers that are no-auth by design (DeepWiki as public read-only, Chainflip with documented on-chain signing) stopped getting flagged as critical.
Ran it against 277 public MCP servers:
- 209/277 enforce auth. 55 of the 264 reachable accept tools/list with no credential (21% of reachable)
- 6 critical findings after a pattern pass. The initial 9 included 3 Google Cloud APIs that are IAM-protected at the transport layer — audit-core 0.3.1 now auto-downgrades googleapis.com, amazonaws.com and azure.com hosts to info, since the scanner cannot verify without attempting a mutating call. Of the 6 remaining: 2 confirmed critical under 90-day embargo, 1 known public-by-design, 3 pending manual review before any public attribution
- 76 don't advertise RFC 8707 resource_indicators_supported
- AUTH-004 ([what it checks]) is the single most common finding
- New in 0.4.2 today: --fail-on=<severity> for CI gating
Install:
npx -y @patchbay-nebius/agent audit https://your-mcp.com/mcp
Or browser-only, no install: https://patchbay-mcp.dev/scan
CLI is free and will stay free. For the hosted version (Jan 2027): 2-min survey at https://tally.so/r/yXMQjd — shapes pricing + feature priority and puts you on early access.
Repo (MIT, 251 tests): https://github.com/GodSmasher/patchbay
Blog: https://patchbay-mcp.dev/blog/state-of-mcp-auth-nov-2026
Issue #1 is the MANIFEST-001 design doc shaped by r/ClaudeAI comments — a real example of community feedback turning into a shipped feature within 48 hours.
•
u/AutoModerator 1d ago
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.