mcp-audit

The server's primary function is to generate and email PDF reports of scan summaries. It follows good security practices by: (1) only transmitting scan *summary* data (counts, risk levels) to the backend, *never* actual secret values or raw configurations; (2) using environment variables for sensitive credentials (Gmail user/password, API key); (3) implementing an API key for its report endpoint; (4) using a client-side approach for GitHub scanning, ensuring user tokens remain in the browser; (5) verifying the integrity of its known MCP registry file with SHA-256. The code shows no signs of 'eval', obfuscation, or direct malicious patterns. The overall design prioritizes privacy and transparency.