{
  "markdown": "# make-audit-mcp\n\nAn [MCP](https://modelcontextprotocol.io) server that **audits Make.com (Integromat) scenario blueprints before you import them**. Blueprints are shared everywhere — template galleries, forums, \"1000 automation\" bundles — and importing one means importing its webhooks, HTTP calls, and whatever credential-shaped strings the author left inside.\n\n- *\"What's in this blueprint?\"* — modules, apps, trigger, routers, error handling, scenario settings\n- *\"Is it safe to import?\"* — hardcoded tokens (masked in output), plain-`http://` calls, dangling module references, unfiltered router routes, missing error handling, log-retention settings\n- *\"What feeds module 5?\"* — mapping-reference tracing in both directions\n\n[Make's official MCP](https://github.com/integromat/make-mcp-server) runs your scenarios; this one reviews the files before they become scenarios. Local files only.\n\n## Quick start\n\n**Claude Code**\n\n```bash\nclaude mcp add make-audit -- npx -y make-audit-mcp\n```\n\n**Claude Desktop** — add to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"make-audit\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"make-audit-mcp\"]\n    }\n  }\n}\n```\n\nThen: *\"Audit C:\\\\Downloads\\\\lead-intake.blueprint.json before I import it.\"*\n\n## Tools\n\n| Tool | What it does |\n|------|--------------|\n| `inspect_blueprint` | Scenario overview: modules, apps, trigger, routers, error handlers, settings |\n| `trace_module` | One module in detail — parameters/mappings (secrets masked), references out and in |\n| `audit_blueprint` | Findings report: errors / warnings / info |\n\n## What the auditor checks\n\n- **Credential-shaped literals** in parameters or mappings (`api_key`, `token`, `Authorization`, `Bearer …`) — connections are stripped on export, so any literal secret is exactly what shouldn't be in a shared file. Values are **masked** (`supe… (18 chars)`) everywhere, including in findings — the auditor never amplifies a leaked token into the model's context.\n- **Dangling references** — mappings like `{{99.output}}` pointing at modules that don't exist (common after hand-editing or merging blueprints). The extractor understands Make's expression syntax: `{{formatDate(2.date; \"X\")}}` references module 2, while `{{parseNumber(3.14)}}` references nothing.\n- Plain-`http://` URLs, webhook triggers (anyone with the URL can invoke), routers where no route is filtered, disabled-but-present modules, no error handlers with DLQ off, `confidential=false` log retention.\n\nKnown limitation: execution-order validation across router branches is not attempted — reference checks are existence-only.\n\n## Development\n\n```bash\nnpm install\nnpm test                 # offline tests — synthetic blueprints built in-suite\nnpm run build            # tsc → dist/\nnode scripts/smoke.mjs   # end-to-end: generates a blueprint, drives the server over stdio\n```\n\nArchitecture: [`src/blueprint.ts`](src/blueprint.ts) (recursive module walk, reference extraction, secret masking) and [`src/audit.ts`](src/audit.ts) (checks) are pure logic; [`src/index.ts`](src/index.ts) is the MCP wiring. Zero runtime deps beyond the MCP SDK.\n\nNot affiliated with or endorsed by Make / Celonis.\n\n## License\n\nMIT\n",
  "bytes": 3200,
  "sha": "a063205aeac44269033b6c1df6827c75fc25925fd82a47023e2e26eadbc8ccd7",
  "repo_slug": "arose26/make-audit-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_arose26_make_audit_mcp_02c6ec46/readme"
}