Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Security audit tool for Claude Desktop and Claude Code on macOS — single-command visibility into MCP servers, extensions, plugins, connectors, scheduled tasks, and permissions.
| Date | Stars |
|---|---|
| 2026-07-31 | 293 |
| 2026-08-06 | 293 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# 🛡️ CLAUDIT-SEC **Security audit tool for Claude Desktop on macOS and Windows — including CoWork, extensions, plugins, MCP servers, connectors, and scheduled tasks.** One command. Full visibility. Read-only. > ⚠️ **Windows support is a work in progress.** We're aware of a few kinks and bugs and wanted to get something out sooner rather than later. Community feedback and contributions are welcome. <p align="center"> <img src="media/claudit-terminal.png" alt="CLAUDIT terminal output" width="700"> </p> ## 🤔 Why Claude Desktop introduces a new class of endpoint risk: AI agents with autonomous execution, persistent scheduled tasks, MCP server integrations, browser-control extensions, and OAuth-authenticated connectors to external services. Most of this configuration lives in JSON files scattered across multiple directories with no centralised visibility. CLAUDIT gives you that visibility in a single command. > 📝 **A note on "Code":** Claude Desktop includes a built-in agent coding feature called **Code** (visible in the app's sidebar). This is **not** the same as **Claude Code**, the standalone terminal CLI. CLAUDIT primarily audits Claude Desktop and its CoWork features. It does include a basic check of the Claude Code settings file (`~/.claude/settings.json` on macOS, `%USERPROFILE%\.claude\settings.json` on Windows), but the focus is squarely on the Desktop app. ## 📋 What It Audits | Area | What's Checked | |------|---------------| | 🖥️ **Desktop Settings** | `keepAwakeEnabled`, sidebar/menuBar preferences | | 🤖 **CoWork Settings** | Scheduled tasks, web search, browser use, dispatch (mobile→desktop), network mode, egress policy, enabled plugins, marketplaces | | 🏢 **Workspaces** | Multi-workspace detection, account names, session counts, org indicators (DXT-managed, org-plugins, dispatch-bridge) | | 🔌 **MCP Servers** | Server names, commands, arguments, environment variable keys | | 🧩 **Extensions (DXT)** | Installed extensions, signature status, dangerous tool grants | | ⚙️ **Extension Settings** | Per-extension allowed directories and configuration | | 🚦 **Extension Governance** | Allowlist enabled/disabled, blocklist entries | | 📦 **Plugins** | Installed, remote (org-deployed), cached (downloaded) | | 🪝 **Plugin Hooks** | Lifecycle hooks executing shell commands (PreToolUse, PostToolUse, Stop, etc.) | | 🔗 **Connectors** | OAuth-authenticated web services, desktop integrations | | 🎯 **Skills** | User-created, scheduled, session-local, and plugin skills across 9 paths | | ⏰ **Scheduled Tasks** | Task names, cron expressions (with plain English translation) | | 🔐 **App Config** | Network mode, extension allowlist/blocklist keys, device identifiers | | 📲 **Dispatch** | Bridge state (OFF/CONFIGURED/ON), active session detection via `hostLoopMode` and `bridge-state.json` | | 🔇 **Disabled MCP Tools** | Per-session tools explicitly disabled (with dangerous tool callout) | | 🏃 **Runtime State** | Running processes, sleep assertions, LaunchAgents, crontab entries | | 🍪 **Cookies** | `Cookies` and `Cookies-journal` presence | > 📖 For a detailed breakdown of every individual check, what it means, and why it matters, see the [Findings Reference](docs/findings-reference.md). ## ⚡ Getting Started ### Prerequisites **macOS:** | Requirement | How to check | How to install | |-------------|-------------|---------------| | 🍎 **macOS** | You're on a Mac | — | | 🐚 **zsh** | `zsh --version` | Ships with macOS since Catalina | | 🔧 **jq** | `jq --version` | `brew install jq` | **Windows:** | Requirement | How to check | How to install | |-------------|-------------|---------------| | 🪟 **Windows 10/11** | You're on a PC | — | | ⚡ **PowerShell 5.1+** | `$PSVersionTable.PSVersion` | Ships with Windows 10+ | | — | No additional dependencies | Fully self-contained | ### Install & Run **macOS:** ```bash git clone https://github.com/HarmonicSecurity/claudit-sec.git cd claudit-sec chmod +x claude_audit.sh ./c
Excerpt of 8,690 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:f8fec64ac8404428, topic:mcp, desc:mcp servers
matched fp:f8fec64ac8404428, topic:ai-security