See what any MCP server can actually touch — before you add it to your agent.
No manifest? You still get the full blast-radius report. Add a manifest to also catch divergences.
Static blast-radius audit for MCP servers before agent install. Manifest optional.
2026-11-09
Stars
—
Tools
—
Uptime
—
Also, if the server declares a manifest: Catch an MCP server that touches files it said it wouldn't — and block the merge in CI.
Statically extract what a third-party MCP server can reach (files, network, subprocess, env) via surface-level analysis. Compare against declared boundaries when a manifest is present.
Scan scope (default): production package only — excludes tests/, docs/, examples/, scripts/, benchmarks/, .github/, and test_*.py patterns; JSON output includes scan_scope and excluded_file_count. Pass --include-peripheral to scan the full repo.
Undeclared capability is usually drift, not malice. Treat network/subprocess counts as upper bounds, not confirmed traffic.
③ Apply for an audit badge (optional, opt-in)
Ran a clean scan and want a signed README badge? Open a badge application — paste your command and JSON. Free, 90-day attestation, no phone-home. Criteria: BADGE_CRITERIA.md.
To verify any published attestation independently: pip install cryptography, then run packaging/scripts/verify_attestation.py (accepts local paths or HTTPS URLs). See BADGE_CRITERIA.md §Verify.
manifest permitted_output_paths / oracle_paths vs observed access
blocking when mismatch
Limitations: Static analysis only. Dynamic imports, getattr/eval, obfuscation, and native extensions may hide capabilities. We do not claim complete coverage — every finding includes a confidence label.
Environment
Variable
Purpose
AOS_VALIDATOR_TARGET_DIR
Default scan root when target_dir is omitted
AOS_VALIDATOR_MCP_LOG
JSONL path for local tool call log (never sent externally)
