adudley78/mcp-audit released v0.28.0. It is a security scanner that sweeps MCP (Model Context Protocol) server configurations to find prompt injection, credential exposure, and supply chain risks. The substantive change in this version, contained in the 2026-11-06 commit (0e984ef), is the addition of a `--fail-closed` option to the `reach` command.
`reach` is a check that gathers the readiness state of each agent into cards. By default it returns exit code 0 when all agents are ready or could not be confirmed, and it is 0 even when not a single agent is found. That is convenient when a human reads the cards, but in an automated gate results that could not be confirmed can be read as a pass. When `--fail-closed` is supplied, the exit code becomes 1 if no agent is found, if any agent's verdict is `couldn't check`, or if collection errors are recorded during the scan, and the reason is printed to stderr. When it is used together with `--fleet`, it also fails on devices with skipped files or more files read than expected, devices with no agents, and devices whose reports still contain errors, and the fleet reader now also counts the `errors` entries of each report. The interactive default remains as is. The complete table of exit codes is in docs/reach.md.
This fix is the result of correcting a fail-open (pass even when it fails) exit problem discovered on 2026-11-06 by Rene Atencio of Alekore Systems while reviewing the repository, and an audit credit was recorded in the CHANGELOG. However, because the interactive default behavior is unchanged, the flow for existing users does not change, and to make a CI gate strict you must specify `--fail-closed` yourself. This commit adds 38 lines and deletes 34 lines across 72 files, most of which are version strings changed from v0.27.0 to v0.28.0 and CHANGELOG entries, and nothing that changes detection accuracy or performance is recorded. It is a fix that teams that have wired MCP configuration checks into CI can use as is, but it is only a feature that changes the strictness of the gate, and it would be premature to regard it as a change that raises detection capability itself.