Before you report
Do not paste real secrets, proprietary MCP configs, private endpoint hostnames, local file paths, or customer names into public reports, screenshots, review prompts, or examples. Use a tiny synthetic config instead.
Public bug reports
For non-sensitive bugs, open a GitHub issue on the MCPAudit project:
github.com/saagpatel/MCPAudit/issues
Include the browser or ChatGPT surface, the expected result, the actual result, and a synthetic config that reproduces the behavior.
Privacy concerns
If you suspect the hosted scanner or ChatGPT app returned raw config text, a secret value, a configured endpoint URL, or a local path, report that as a privacy concern. Use a synthetic reproduction if possible and avoid posting sensitive material publicly.
Private or production configs
For private configs, use the local CLI path so the scan stays on your machine:
uvx --from mcp-audits mcp-audit scan
Scope questions
The hosted scanner is config-only. It does not store pasted config text by application design. It does not launch configured MCP servers. It does not contact configured MCP endpoints. It can show declared launch shape and inferred review surfaces, but it does not inspect live tool descriptions or certify a server as safe. Connected checks belong in the local MCPAudit CLI.