MCP Magento Audit

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/michalper-mcp-magento-audit

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools

6 read · 2 write · 0 delete

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (8)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• audit_security

  Checks every installed package in the given Magento project's composer.lock — core Magento, third-party vendor/ extensions, dev dependencies, not just custom app/code — against known security advisories via `composer audit`. Returns scanned=false with a reason (e.g. no composer.lock, composer not found) rather than silently reporting zero advisories when the check never ran.

• build_fleet_overview

  Triages many Magento projects at once against a target PHP/Magento version — 'which of these N stores can be upgraded today'. Runs only check_updates per project (composer-constraint verdicts, plus code_compatibility if the project has its own rector.php) — deliberately not the full build_upgrade_plan, since scan_module_risk's phpcs/phpstan/rector and audit_security's/check_outdated_packages' composer calls are each seconds-to-minutes and don't scale across a whole fleet in one call. A project reported blocked=false here can still have scan_module_risk/audit_security findings that build_upgrad…

• build_upgrade_plan

  Builds an upgrade plan for the given Magento project against a target PHP and Magento version by combining check_updates, scan_module_risk, audit_security, check_outdated_packages and fetch_release_notes. The verdict is a list of concrete blockers (composer constraints, code that Rector flags as needing changes, phpcs/phpstan errors in the project's own app/code, security advisories against installed packages), each with its own reason — not a single abstract score. check_outdated_packages and vendor/-scope scan_module_risk issues are informational only (included in the full result, not in blo…

• check_outdated_packages

  Checks every installed package in the given Magento project's composer.lock against `composer outdated` to report which ones have a newer version available — independent of audit_security (known CVEs) and check_updates (compatibility with a target PHP/Magento version): a package can be behind on releases with neither of those issues, and that's still tech debt worth surfacing. Each package's own latest-status (e.g. semver-safe-update vs update-possible) is included as reported by Composer. Returns scanned=false with a reason (e.g. no composer.lock, composer not found) rather than silently repo…

• check_updates

  Checks the given Magento project against a target PHP and Magento version, with two independent signals: a per-package verdict ('ok', 'blocks' or 'unknown') from declared composer.lock PHP requirements, and code_compatibility — whether the project's own code would actually need changes under the target PHP, via a Rector dry-run (declared requirements are often just '*', which alone gives a false sense of readiness). The PHP requirement for the target Magento version comes from a local cache, a live fetch, or an offline fallback table, in that order — the result says which one was used.

• fetch_release_notes

  Fetches Magento's own release notes for a given version from the magento/magento2 GitHub repo's Releases API — never reconstructs them from training data. Returns found=false with a reason when nothing could be fetched, rather than guessing what a release might have contained.

• get_project_status

  Reads composer.json and composer.lock of the given Magento project and returns its state: Magento version, PHP requirement, package count and the list of packages abandoned by their authors. Call this first for a fast, composer-only overview before the deeper (and slower) checks like check_updates, scan_module_risk or build_upgrade_plan.

• scan_module_risk

  Scans the given Magento project's custom code for coding-standard violations, static-analysis issues and dead-code/quality suggestions by shelling out to the project's own vendor/bin/phpcs, vendor/bin/phpstan and vendor/bin/rector. phpcs: if the project has its own phpcs.xml(.dist), that configuration is used as-is; otherwise falls back to the Magento2 standard on app/code. phpstan and rector: only run if the project has its own phpstan.neon(.dist)/rector.php — unlike phpcs there is no safe generic fallback (no paths/level/extensions/rule sets to guess), so they're skipped rather than guessing…

Signals

Stars

0

Forks

0

Open issues

0

Weekly downloads

686

Last commit

Oct 18, 2026 (13 days ago)

Last release

Oct 18, 2026 (13 days ago)

Last package publish

Oct 18, 2026 (13 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.michalper/mcp-magento-audit

Version

0.4.0

Auth

No auth

Packages

pypi mcp-magento-audit

License

MIT

Repository

github.com/michalper/mcp-magento-audit

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql