grim-mcp

Security audit for AI agents. Finds code, dependency, exposure, secrets, and active-compromise gaps across any stack, with drift detection and SBOM.

latest

Source

npm

Version: 0.6.3

Version published: yesterday

Weekly downloads: 2.2K

Maintainers: 1

Weekly downloads

Created: 5 days ago

Source

grim-mcp

Security audit MCP server. Finds the gaps, exposures, and active compromise that other scanners miss.

grim-mcp is the MCP distribution of GRIM. The engine is Python that uses only the standard library. This package bundles it and runs it as a stdio MCP server, so any MCP client can use it with npx.

Requirements

Node.js 18 or newer
Python 3.10 or newer on PATH (override with GRIM_PYTHON)

Use with an MCP client

{
  "mcpServers": {
    "grim": { "command": "npx", "args": ["-y", "grim-mcp"] }
  }
}

Or directly:

npx -y grim-mcp            # MCP server on stdio (default)
npx -y grim-mcp version    # print the engine version
npx -y grim-mcp list       # list audit tools

Or install the Python package instead:

pip install grim-mcp
grim mcp

Tools

Tool	Purpose
`detect_stack`	Identify the stack and web served directories
`audit_deps`	Known CVEs in dependencies through the live OSV database
`scan_secrets`	Leaked keys, tokens, private keys, and env files, with optional git history
`scan_code`	SAST across many languages
`audit_exposure`	Webshells, polyglots, ELF binaries, exposed config and backups, nested archives
`diff_artifacts`	Baseline and current drift, the active compromise check
`watch`	Save a baseline and detect drift
`plan`	Ordered, explainable audit plan for a target
`sbom`	CycloneDX 1.5 or SPDX 2.3 bill of materials
`scan_iocs`	Match file hashes against a known bad indicator store, plus EICAR
`update_feeds`	Sync detection rules and indicators from a JSON feed
`ledger`	Track findings as new, known, reopened, or resolved
`inventory_endpoints`	Routes with method, auth middleware, input surface, and risk
`malware_scan`	Built in heuristics and IoC, plus ClamAV and YARA when installed
`check_live`	Opt in, scope gated live checks
`fix_plan`	Remediation steps and safe unified diffs
`ci_scan`	CI gate that returns an exit code by severity
`report`	Unified Markdown, JSON, or SARIF report