mcpField
E
elicitation-auditor

elicitation-auditor

Local
github.com/GuardBeeSecurity1Updated 1d ago
Repository

About elicitation-auditor

elicitation-auditor statically analyzes MCP server source code for security anti-patterns in elicitation flows. It is intended for developers and checks risks such as secrets in forms, authorization URLs, identity handling, and ignored cancellations.

Key features

  1. 01Scan for elicitation security anti-patterns
  2. 02Check whether forms request secrets
  3. 03Detect authorization URLs and sensitive URL data
  4. 04Check whether form answers are treated as identity
  5. 05Find code that ignores decline or cancellation

Use cases

  1. 01Review elicitation implementations in MCP servers
  2. 02Check source code for security issues before submission
  3. 03Export scan findings as text, JSON, or SARIF

MCP support

As an MCP server, it exposes tools to scan text, individual files, and directories, and to list the checks.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "guardbee-elicitation-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-elicitation-auditor"
      ]
    }
  }
}
Run commandnpx -y @guardbee/mcp-elicitation-auditor

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@guardbee/mcp-elicitation-auditor0.2.2

Tools

4

Saved tool list · updated 1w ago

ParameterTypeRequiredDescription
labelstringNoOptional label shown in findings (e.g. filename)
contentstringYesThe code content to scan

Details

From the project README

@guardbee/mcp-elicitation-auditor

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

npm version npm downloads License: MIT

An MCP server that scans MCP server source for elicitation anti-patterns in the 2026-07-28 specification.

That revision deprecated sampling and roots. Elicitation is the remaining way a server asks the client for something. Form mode collects structured data through the client. URL mode sends the user to a page the client must not read. The spec draws a hard line between them.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► elicitation-auditor ──► MCP server source
              │
              ├─ form-secrets   (form mode asks for a password, API key, token, or card, or embeds a link)
              ├─ url-binding    (URL mode opens a third-party /authorize endpoint directly)
              ├─ url-exposure   (credential or email embedded in the elicitation URL)
              ├─ transport      (cleartext http URL outside localhost)
              ├─ identity       (a form answer is treated as who the user is)
              └─ completion     (the result is used without checking decline or cancel)

What it flags

  • Form-mode secrets. elicitInput / ctx.elicit / elicitation/create with mode omitted or form, whose schema asks for password, apiKey, access_token, cvv, and the same family. A name and email form is allowed by the spec and is not flagged. secretQuestion is not treated as secret.
  • Direct third-party authorize. URL mode whose url path contains authorize, oauth, or oauth2, unless the path goes through your own /connect route. That is the forwarded-link phishing case in the spec: the user who opens the link must be checked against the MCP user before any redirect.
  • Credential or personal data in the URL. Query keys such as access_token, code, or email. The URL is shown to the MCP client.
  • Cleartext HTTP, except localhost and 127.0.0.1.
  • Clickable URL in a form. A form message or field description that contains an http link. The spec says that link belongs in URL mode.
  • Form answer used as identity. The submitted email or username is passed to findUser, loginAs, or assigned to req.user, with no comparison to the token sub claim.
  • Ignored decline/cancel. Code reads .content and never looks at .action, decline, or cancel. Checking action !== "accept" is enough. Sending the email as a notification address is not treated as an identity check.

Tools

ToolPurpose
scan_textScan a source string
scan_fileScan one file
scan_directoryRecursive scan
list_patternsList the checks

CLI

npx @guardbee/mcp-elicitation-auditor scan <path> [--fail-on=any] [--format=text|json|sarif]

guardbee.yml:

elicitation-auditor:
  fail-on: high
  max-files: 5000
  exclude:
    - ".test.ts"

No API key. Static analysis only.

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.