Issues

• The Engine takes injected rules, but there is no way for a user to supply one

  enhancementhelp wanted
  AgentPostmortem/MCP-audit#16 · Filter by author royalpinto007 opened on Aug 6, 2026

• The linter has no linter: npm run lint is just tsc, and CI never runs it

  enhancementgood first issue
  AgentPostmortem/MCP-audit#15 · Filter by author royalpinto007 opened on Aug 6, 2026

• No timeouts anywhere: a server that stalls listTools hangs the audit forever

  bugenhancementhelp wanted
  AgentPostmortem/MCP-audit#13 · Filter by author royalpinto007 opened on Aug 6, 2026

• The CLI silently ignores unknown flags, so a typo in --fail-on disables the gate

  bugenhancementhelp wanted
  AgentPostmortem/MCP-audit#12 · Filter by author royalpinto007 opened on Aug 6, 2026

• MCP031 misses path arguments nested inside objects or arrays

  bughelp wanted
  AgentPostmortem/MCP-audit#8 · Filter by author royalpinto007 opened on Aug 6, 2026

• Unknown rule ids in --only / --disable / severityOverrides are silently ignored

  enhancementhelp wanted
  AgentPostmortem/MCP-audit#6 · Filter by author royalpinto007 opened on Aug 6, 2026