Audit
The Audit tab covers two supply chains: the packages you depend on, and the MCP servers your coding agent is configured to launch. It reads dependency manifests, not your source code.
Backends
Scanners are not bundled. Each backend is probed on PATH before it runs, and a missing one becomes an entry telling you what to install rather than a silent gap. Installing osv-scanneralone gives the broadest coverage, since it reads every ecosystem from lockfiles.
| Backend | Needs installed | Covers |
|---|---|---|
| osv-scanner | osv-scanner | Every ecosystem, from lockfiles |
| npm audit | npm | npm |
| cargo audit | cargo-audit | Rust crates |
| pip-audit | pip-audit | Python |
| govulncheck | govulncheck | Go, reachable calls only |
| Snyk | snyk, authenticated | Multi-ecosystem |
| Socket | socket | Supply chain signals |
| Agent config | Nothing, built in | MCP server trust |
Ecosystems discovered
It walks the repository for manifests and pairs each with its lockfile when one exists, so a monorepo with several ecosystems produces one report rather than one run per directory.
The agent configuration scan
An MCP server runs as a local process with your agent's file and network access. This half of the audit parses the four common config paths and needs no scanner and no network, so it works on any machine and in any repository.
| Finding | Severity | Triggered by |
|---|---|---|
| TRUST-MCP-UNPINNED | High | An unpinned fetch such as npx -y pkg |
| TRUST-MCP-REMOTE-PLAINTEXT | High | A server URL on http:// |
| TRUST-MCP-REMOTE | Medium | A server URL on https:// |
| TRUST-MCP-SECRET-ENV | Medium | Credential-shaped env keys passed to a server |
Applying fixes
The audit persona starts in plan mode with read, shell and search tools but no ability to write. Choosing Apply fixes grants editing tools for that session and the upgrades land in your working tree, which you review as a normal diff. It does not branch, commit or open a pull request.
Reading severities honestly
Severity comes from whichever scanner reported the finding, and several do not report one. Those arrive as ungraded and are counted separately in the summary. Ungraded does not mean low; it means nobody classified it. The per-backend tabs exist so you can see which tool said what.
What this is not
It reads manifests and configuration, never your source. It will not find an injection flaw, a broken authorisation check or a hardcoded credential in code you wrote. There is no SBOM export, no license compliance check and no container or infrastructure scanning.
From another agent
The audit is exposed over Lucid Train's own MCP server, so it arrives inside a Claude Code, Codex, Cursor CLI or OpenCode session as mcp__lucid__security_audit and is pre-approved rather than prompting on first use.