Getting Started with MCP Audit: Your First Server Scan
From URL to security report in 90 seconds. A step-by-step walkthrough. April 2026.
You have an MCP server you want to check. Maybe you found it on GitHub. Maybe someone recommended it. Maybe it is already in your agent's config and you realized you never actually looked at what it does.
This tutorial walks through running your first audit on audit.pyfio.com. It takes about 90 seconds from start to finish.
What you need
- A GitHub URL for a public MCP server repository
- A browser
- That is it
Step by step
Open audit.pyfio.com in your browser. You will see a single input field. No signup required for public repos.
Copy the URL of the MCP server's GitHub repository. For example: https://github.com/anthropics/anthropic-tools. Paste it into the input field and hit Enter or click Scan.
The URL should point to the repo root, not to a specific file or directory.
The audit typically takes 30 to 90 seconds depending on repo size. The scanner clones the repository, analyzes the code, checks dependencies, reviews permissions, and generates a scored report. You will see a progress indicator while it runs.
The report shows an overall score from 0 to 100, plus individual scores for five categories. Each finding is listed with its severity level (critical, high, medium, or info) and a description of what was found.
Understanding the scores
The overall score is a weighted average of five categories:
- Permissions and Scope (30% weight): Does the server request more access than it needs? Filesystem, network, shell execution, environment variables.
- Code Safety (25%): Are there dangerous patterns in the source code? Dynamic execution, injection vectors, unsanitized inputs.
- Supply Chain (20%): Are the dependencies trustworthy? Lockfile present? Suspicious packages? Install scripts?
- Transparency (15%): Is there a license? Security documentation? Clear description of what the server does?
- Maintenance (10%): Is the project actively maintained? Recent commits? Issues being addressed?
What the numbers mean
Reading the findings
Each finding in the report includes:
- Severity: Critical, high, medium, or info. Critical and high findings are the ones that need attention.
- Category: Which of the five categories the finding belongs to.
- Description: What was found, and where in the codebase (file path and line number when applicable).
- Why it matters: A brief explanation of the risk.
What to do after the scan
If the score is 90+: Review any specific findings, but you are probably fine. Proceed with normal caution.
If the score is 70-89: Read each finding. For high-severity issues, check the actual code at the file and line number mentioned. Decide whether the risk is acceptable given what you need the server to do.
If the score is below 70: Look at the findings carefully. Consider whether an alternative server exists that does the same thing with fewer risks. If you must use this server, understand exactly what risks you are accepting.
If the scan says "no source files found": The server is likely written in a language the scanner does not yet fully support (Go, Rust, Python). The code safety score will be incomplete. The other four categories are still valid.
Scanning your own servers
If you maintain an MCP server, run the audit on your own repo. It is the fastest way to find issues before your users find them. Fix what you can, document what you cannot, and link to the audit report in your README to build trust.
Try it now
Pick an MCP server. Any one you use or are considering. Go to audit.pyfio.com and paste the URL. Ninety seconds later, you will know more about that server than most people who have been using it for months.
Run your first audit
Free for public repos. No signup required.
Go to audit.pyfio.com View LeaderboardGet MCP security updates
New findings, tool updates, and practical guides. Weekly, no spam.