[raymondginger2018-sudo]

Summary

Add deepcode mcp audit [--json]: a supply-chain declaration audit over the
effective MCP inventory (lesson 13, third-party / supply-chain warning).
Pure mechanism — no network, no execution.

Changes

• core/mcp/audit.py (new, +142): per-server entries from the flat
  McpInventory (transport provenance: stdio command vs remote URL, tool
  filter, approval mode, missing env keys) + risk lines. Disabled servers
  introduce no runtime exposure and yield no risk lines, mirroring the
  posture rules in mcp list.
• cli/mcp_cli.py (+23): audit subcommand wired through the existing
  application.mcp.list(project_id) path; human output prints a server
  table plus risk: lines, --json emits the full report.
• tests/test_mcp_audit.py (new, 6 cases with duck-typed fakes) +
  tests/test_mcp_cli.py (+1 end-to-end case with a direct-config server).

Tests

• pytest tests/test_mcp_audit.py tests/test_mcp_cli.py -> 14 passed;
  ruff check + ruff format green (pre-commit pinned rev, hooks passed at
  commit).

Dependency note

• No new dependencies; reads only existing inventory fields. Notably avoids
  the missing core.mcp.naming.server_allowed symbol that killed the
  earlier audit attempt (feat(mcp): supply-chain audit declarations for MCP servers #220); complements the landed mcp list
  concerns/posture work (feat(mcp): name per-server concerns and default posture in mcp list #241) with a diffable audit report.

[Zongwei9888]

Thank you for putting this together. We're going to close it, and here is why:

• It repeats deepcode mcp list. The same servers and fields are already in mcp list / mcp list --json, and _mcp_concerns (cli/mcp_cli.py:346) deliberately states the "exposes all tools" default once, while the audit reports it as a risk on every server.
• It can be wrong about invalid servers. A server whose config is invalid is not skipped: in our run, a server set to enabledTools: ["search"] but invalid was still reported as exposing ALL tools, which _posture_summary explicitly avoids.
• It misses the supply-chain facts that matter. args is ignored, so npx -y some-pkg@latest prints only npx, and credential_env_keys isn't considered. It also reads fields by name instead of through McpServerInfo, which we'd have to keep in sync by hand.

What we'd gladly take: a small PR that adds a concern to mcp list itself, for example an unpinned package (npx/uvx with @latest or no version) or a server that receives credential environment variables. That would reach every user of mcp list without a second command to maintain.