Skip to main content

​
Quick Reference

CommandPurpose
golf-scanner auditDiscover MCP servers and run a full security audit with risk scores
golf-scanner scanList discovered MCP servers without running checks
golf-scanner versionPrint version information
golf-scanner helpShow usage information

​
audit

Discover all MCP servers configured across your IDEs and run 20 security checks against each one. Produces a 0–100 risk score per server.

​
Syntax

golf-scanner audit [options]

​
Options

FlagDefaultDescription
--offlinefalseSkip network checks (OSV, GitHub, npm, PyPI, MCP Registry, OCI registries)
--formattableOutput format: table or json
--jsonfalseShorthand for --format json
--fail-onExit code 1 if findings at or above severity: note, medium, high, critical
--verbose, -vfalseShow full finding details including remediation text
--quiet, -qfalseShow only the summary table (no per-server details)

​
Flag Interactions

  • --verbose and --quiet are mutually exclusive — using both produces an error
  • --json is shorthand for --format json — both do the same thing
  • --offline skips all Tier 2 checks (11 of 20 checks require network)

​
Examples

Full audit with all checks
golf-scanner audit
Offline only (no network requests)
golf-scanner audit --offline
Verbose with remediation details
golf-scanner audit --verbose
Summary table only
golf-scanner audit --quiet
CI/CD — fail on high or critical
golf-scanner audit --fail-on high --json
CI/CD — fail on any finding
golf-scanner audit --fail-on note --json

​
scan

List MCP server configurations discovered across your IDEs without running any security checks. Reads configuration files for Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Kiro, and Antigravity.

​
Syntax

golf-scanner scan [options]

​
Options

FlagDefaultDescription
--formattableOutput format: table or json
--jsonfalseShorthand for --format json

​
Examples

List all discovered MCP servers
golf-scanner scan
JSON output for scripting
golf-scanner scan --json

​
version

Print the Golf Scanner version string.

​
Syntax

golf-scanner version

​
Example Output

golf-scanner v0.1.0

​
help

Show usage information for all commands.

​
Syntax

golf-scanner help
golf-scanner --help
golf-scanner -h

​
Environment Variables (Optional)

Golf Scanner works without any environment variables. These are optional and only affect online (Tier 2) checks:
VariablePurpose
GITHUB_TOKENGitHub API authentication — increases rate limit from 60 to 5,000 requests/hour
GOLF_GITHUB_TOKENFallback if GITHUB_TOKEN is not set
Set GITHUB_TOKEN when running online checks to avoid rate limiting on GitHub Trust checks: 
export GITHUB_TOKEN=ghp_your_token_here
golf-scanner audit

​
Exit Codes

CodeMeaning
0Success — audit completed, no threshold exceeded
1No arguments provided, unknown command, --fail-on threshold exceeded, or --verbose/--quiet conflict
2JSON marshaling error or invalid --fail-on severity value