correctover-audit-mcp

Free self-service MCP session-security audit as an MCP server. Ask your agent to audit an MCP endpoint and get a re-verifiable verdict (e.g. unauthenticated-surface) from 3 read-only probes — no handshake forgery, no exploit payloads.

Part of the Session-as-Identity research line: DSHCorrectover/mcp-session-audit (protocol + CI action + evidence).

Install (one line)

claude mcp add correctover-audit -- npx -y github:DSHCorrectover/correctover-audit-mcp

Then ask your agent: "audit https://your-server.example/mcp for session-security issues".

What it checks

probe	meaning
initialize (anonymous)	does the server issue a session at all?
tools/list (zero handshake)	can an anonymous client enumerate the full tool inventory?

Verdict classes: unauthenticated-surface (exposed) / authenticated-ok / error-*.

Honest scope

• Read-only probes only; audit endpoints you own or are authorized to test.
• The verdict is evidence-grade (timestamps + reproduction command), not a certification.
• Deeper fail-closed review with signed evidence dossiers: wangguigui@correctover.com

MIT © 2026 Guigui Wang (Correctover) — "We sell the verdict, and you can re-verify it yourself."