mcp-audit

# MCP Audit Inventory and audit every Model Context Protocol server the user has configured — both user-scope and project-scope — read through the Agent Monitor dashboard at `http://localhost:4820`. ## Input The user provides: **$ARGUMENTS** This may be: - empty — audit all MCP servers (default). - a server name fragment — focus on matching servers. - "stdio" / "http" — restrict to one transport kind. ## Data Sources | Endpoint | Returns | |----------|---------| | `GET /api/cc-config/mcp` | `{ user:[…], projectScoped:[…] }`. Each server: `{ name, source, kind }` where `kind` is `stdio` (with `command, args, envNames`), `http` (with `url, headers`), or `unknown`. `source` names the file the definition came from (e.g. `~/.claude.json (top-level)`, `~/.claude.json (projects[<root>])`, `~/.claude/settings.json`) | ## Report Sections ### 1. Server inventory List every server from `user` and `projectScoped`. For each show `name`, `source`, `kind`, and the transport detail: - **stdio** — the `command`, its `args`, and the `envNames` (names only — values are not exposed by the API). - **http** — the `url` and the `headers` key names (values not exposed). - **unknown** — a definition the server could not classify; flag it for review. ### 2. Scope split & duplication Separate user-scope from project-scope servers. Flag any `name` that appears in both scopes (project may shadow user) and any duplicate definitions across source files. ### 3. Hygiene flags - **Unknown transpor...