frontpage.

Hi HN — I built APIsec MCP Audit, an open source tool to audit Model Context Protocol (MCP) configurations used by AI agents.

Developers are connecting Claude, Cursor, and other assistants to APIs, databases, and internal systems via MCP. These configs grant agents real permissions, often without security oversight.

MCP Audit scans MCP configs and surfaces:

- Exposed credentials (keys, tokens, database URLs) - What APIs or tools an agent can call - High-risk capabilities (shell access, filesystem access, unverified sources)

It can also export results as a CycloneDX AI-BOM for governance and compliance.

Two ways to try it:

- CLI: pip install mcp-audit - Web demo: https://apisec-inc.github.io/mcp-audit/

Repo: https://github.com/apisec-inc/mcp-audit

We're a security company (APIsec) and built this after repeatedly finding secrets and over-permissioned agent configs during assessments. Would appreciate feedback — especially on risk scoring heuristics and what additional signals would be useful.

Show HN: LocalGPT – A local-first AI assistant in Rust with persistent memory

Show HN: It took 4 years to sell my startup. I wrote a book about it

Show HN: Fine-tuned Qwen2.5-7B on 100 films for probabilistic story graphs

Show HN: Claude Code skill that uses Codex as MCP server for code review

Show HN: I saw this cool navigation reveal, so I made a simple HTML+CSS version

Show HN: Real-time path tracing of medical CT volumes in the browser via WebGPU

Show HN: Portview, A diagnostic-first port viewer for Linux (~930 KB, zero deps)

Show HN: Google Maps but for your repo (Open Source)

Show HN: Elysia JIT "Compiler", why it's one of the fastest JavaScript framework

Show HN: A luma dependent chroma compression algorithm (image compression)

Show HN: HalalCodeCheck – Verify food ingredients offline

Show HN: FlashMesh – An encrypted file mesh across Google Drive and Dropbox

Show HN: WeaveMind – AI Workflows with human-in-the-loop

Show HN: Analyzing 9 years of HN side projects that reached $500/month

Show HN: Kappal – CLI to Run Docker Compose YML on Kubernetes for Local Dev

Show HN: Kybera – Agentic Smart Wallet with AI Osint and Reputation Tracking

Show HN: Smooth CLI – Token-efficient browser for AI agents

Show HN: Free Bank Statement Analyzer to Find Spending Leaks and Save Money

Show HN: A2A Protocol – Infrastructure for an Agent-to-Agent Economy

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

Show HN: Solnix – an early-stage experimental programming language

Show HN: If you lose your memory, how to regain access to your computer?

Show HN: I spent 4 years building a UI design tool with only the features I use

Show HN: MuxPod – A mobile tmux client for monitoring AI agents on the go

Show HN: OpenCode for Meetings

Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust

Show HN: Open-source AI powered Kubernetes IDE

Show HN: Lucid – Use LLM hallucination to generate verified software specs

Show HN: BioTradingArena – Benchmark for LLMs to predict biotech stock movements