Start with the protocol contract, not a generic malware scan
For MCP, record the server and tool name, input schema, arguments, and returned result. The current MCP specification treats tools as code-execution capabilities and explicitly warns that tool annotations are not trustworthy unless the server is trusted. The audit question is whether the observed implementation behavior is consistent with the capability the user authorized, not whether every file or socket event is inherently suspicious.
Design one bounded task that exercises the capability
Use a prompt or direct test that invokes one target capability and avoid unrelated permissions. Pin the server or extension version, working directory, configuration, and transport. A narrow task makes attribution possible: when a process starts or a path is touched, you can connect it to a concrete tool call rather than a long interactive session containing unrelated work.
Correlate the tool result with the process family
A successful tools/call result tells you what the server returned to the host. System observation can add which executable handled the request, which children it spawned, and when those processes exited. This matters for wrappers and helpers: the server process may delegate the actual work to git, curl, a package manager, a browser, or another runtime whose behavior never appears as a separate MCP protocol event.
Inspect file and network scope in context
Group paths into project, expected runtime/configuration, temporary/cache, and unexplained external locations. Group network destinations by model provider, package or source host, localhost service, and unexplained remote service. A database tool contacting its database or a GitHub tool contacting GitHub can be expected; a destination unrelated to the requested capability deserves reproduction and source review.
Use both stdio and network fixtures when transport matters
AgentSight ships a minimal MCP test fixture with predictable echo, sum, and file-read tools over stdio and HTTP. That fixture is useful for validating your capture path before auditing a third-party server: stdio exercises local pipe communication and process attribution, while HTTP provides a simple network baseline. Establishing that the tracer works on a known fixture reduces false conclusions when a production server uses a different transport.
Report scope and uncertainty explicitly
A single run is a sample of one server version, configuration, task, and approval path. Record what was exercised, what probes were active, and which effects were observed. Do not claim that unobserved capabilities are safe, and do not label a normal cache write or network connection malicious without tying it to an authorization or implementation concern. Reproduce unexplained effects before making a security claim.
$ sudo agentsight record -- <agent-command>
$ agentsight report audit --json
$ python3 docs/mcp-test/test_mcp_cli.py --transport stdio