rev2ret/SecureAudit-MCP

**A Model Context Protocol (MCP) Server for C/C++ Static Code Auditing & Compiled PE/ELF Binary Security Parsing.**
*Equip your AI Coding Agents (Claude Code, Cursor, Cline) with safe, low-level binary analysis and secure static code scanning tools.*
***
🚀 Why SecureAudit-MCP?
AI Coding Assistants and Agentic loops are incredible at writing code, but they lack local system capabilities to check low-level binary compilation properties or perform deep static secure auditing.
**SecureAudit-MCP** solves this by standardizing tools under the **Model Context Protocol (MCP)**. By registering this server, your AI agent gains native, sandboxed commands to inspect C/C++ source code files for severe logic and library errors (like buffer overflows, format vulnerabilities, and command injections), parse local executables (Windows PE / Linux ELF) for binary hardening features (ASLR, DEP/NX, PIE), and extract printable ASCII strings securely.
***
🛠️ Features & Tools
1. audit_source_code
* **Purpose:** Performs lightweight static analysis scans on C/C++ source files.
* **Checks:**
* Unsafe standard library functions (strcpy, gets, sprintf, scanf).
* Heap overflow risks (like signed multiplications inside malloc).
* Format string vulnerabilities (printf(variable) instead of printf("%s", variable)).
* System-level command injection entry points (system()).
* Basic memory leaks (unmatched malloc vs free statement loops).
2. check_binary_protections
* **Purpose:** Safely reads raw binary headers (first 1024 bytes) to check for defensive security compile flags.
* **Capabilities:**
* Identifies formatting magic signatures (**PE** for Windows executables, **ELF** for Linux).
* Evaluates architecture sizes (32-bit vs 64-bit).
* In PE optional headers, parses DllCharacteristics to check for **ASLR (Dynamic Base)**, **DEP/NX (Data Execution Prevention)**, and **SafeSEH**.
* In ELF headers, parses ELF type to identify **PIE (Position Independent Executable)** compiling.
3. safe_extract_strings
* **Purpose:** Securely parses ASCII string constants from compiled binaries (acting as a safe, local implementation of the standard Linux strings CLI utility) to identify indicator hashes, embedded secrets, or hardcoded URLs.