mcp-integration-audit

Claude MCP integration scoping depends on the integration's purpose: local for individual use, project for shared repository tooling, or user for cross-project access. The audit evaluates your specific integration to recommend the safest configuration scope.

A shared .mcp.json file is safe only if it excludes secrets and uses the smallest safe team config pattern. The audit evaluates whether your repository's planned MCP integrations can safely use a shared configuration without exposing sensitive credentials.

Secrets management for MCP servers requires keeping credentials out of source control. The audit evaluates your integration plan to identify the safest approach for team workflows, ensuring secrets remain protected while maintaining functional configurations.

Windows stdio server pitfalls often stem from npx execution issues, particularly around `cmd /c npx` usage. The audit flags these brittle setups and recommends configuration patterns that avoid common Windows-specific stdio problems.

Project scope suits shared infrastructure tools like GitHub, Sentry, or database connections needed by the whole team, while user scope fits personal integrations. The audit determines the appropriate scoping by evaluating each integration's purpose and audience.

The smallest safe team configuration pattern uses a shared .mcp.json for non-sensitive project-scoped integrations while keeping secrets and user-specific credentials separate. The audit evaluates your integrations and outlines this minimal pattern for your team.