durin
Book a demo

AI & MCP Risk Audit

Find the gaps in your AI setup. Answer ten questions or check an agent config, see your overall grade, then add your details to download the full report.

Start your assessmentSee a sample report
Question 1 of 10

Do you keep a list of the AI agent tools employees use?

  • Yes, and it is up to date
  • Partly, or it is out of date
  • No
  • Don't know
  1. Assess your setup
  2. Review your result
  3. Download your report

Start without an email. Add your details at the end for the full report and downloads.

Start with what you know.

Choose the evidence you have. The tool guides you through the assessment and explains what the result is based on.

Answer ten questions

No config files needed

One question at a time about how your organization uses AI. Go back, change an answer or return later. Progress stays in this browser.

Paste a config file

Review before you send

Check an agent setup you already have. Review the masked facts before sending them for grading. The raw config stays on your device.

Run the CLI on a machine

For a local configuration check

Read supported agent configs and grade them offline. Verify your email in the tool to get the command and its signed token.

What happens to your data

Know what stays with you, what is sent for grading and what we keep when you request your report.

How your data movesPrivacy notice
  • Processed in memory and discarded when your report is returned; we keep your email and consent, and rate-limit data.
  • Secrets are masked in your browser before anything is sent, and the server checks again and drops anything that still looks like one.
  • No analytics, chat or advertising scripts. Optional example videos load YouTube only when you choose to play them.
  • The grade is a risk signal, not a certification. Every finding shows its evidence and how it was established.
Start your assessment

Know what to review next.

See your overall grade first. When you’re ready, verify your work email to download six risk areas, supporting evidence and practical fixes.

Explore the full sample report

Explore an illustrative report built from synthetic Claude Code, Cursor and Windsurf configs.

D · High risk

9 issues, including missing basic controls.

Agent client configuration on one machine · 4 config files · Generated 2026-10-09

Risk areas

  • Shadow AI

    What is connected that nobody approved?

    A Low risk

    Findings: 1

  • Access and credentials

    Who and what can reach which systems, and how are the keys kept?

    A Low risk

    Findings: 0

  • Agent actions

    What can agents change without a person saying yes?

    F Very high risk

    Findings: 3

  • Data exposure

    What sensitive data can agents reach, and where does it go?

    C Elevated risk

    Findings: 2

  • Audit trail

    Can you prove who did what?

    B Some risk

    Findings: 2

  • Supply chain

    Can you trust the servers and vendors your agents rely on?

    C Elevated risk

    Findings: 1

Priority fixes

  1. Tools that change data are approved in advance

    Remove whole-server and wildcard entries from the always-allow list.

    Quick fix · Raises the overall score by 8.4 points

  2. Servers download new code each time they start

    Pin each package to an exact version, for example @scope/name@1.2.3, and review upgrades.

    Quick fix · Raises the overall score by 5.9 points

  3. A server lets agents run code or shell commands

    Remove the server, or run it in a container or sandbox with limited access.

    Some work · Raises the overall score by 4.2 points

Findings

Critical Quick fixAA-2

Tools that change data are approved in advance

Why it matters

Pre-approved tools that write or delete run without a person seeing them first.

Evidence

Every tool of playwright, including tools that delete, is pre-approved in ~/.claude/settings.json (Read from a config file)

create_pull_request on github is pre-approved in ~/.claude/settings.json (Inferred from a name)

Fix

  1. Remove whole-server and wildcard entries from the always-allow list.
  2. Pre-approve only named read-only tools.

Durin does this: Durin can require a person's approval for each write, tied to its exact arguments, or block writes entirely. Book a demo

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.3, A.8.2

SOC 2 Trust Services Criteria: CC6.3, CC8.1

GDPR: Art. 32

High Quick fixSC-1

Servers download new code each time they start

Why it matters

A changed or compromised package runs on this machine without anyone reviewing it.

Evidence

github runs npm package @modelcontextprotocol/server-github with no fixed version (~/.claude.json) (Read from a config file)

playwright runs npm package @playwright/mcp with no fixed version (~/.claude.json) (Read from a config file)

linear runs npm package mcp-remote with no fixed version (~/.cursor/mcp.json) (Read from a config file)

postgres runs npm package @modelcontextprotocol/server-postgres with no fixed version (~/.cursor/mcp.json) (Read from a config file)

Fix

  1. Pin each package to an exact version, for example @scope/name@1.2.3, and review upgrades.

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.19, A.5.20, A.5.21, A.5.22

SOC 2 Trust Services Criteria: CC9.2, CC7.1

GDPR: Art. 28

High Some workAA-3

A server lets agents run code or shell commands

Why it matters

Running code lets an agent do anything the user's account can do.

Evidence

playwright in Claude Code (~/.claude.json) (Read from a config file)

postgres in Cursor (~/.cursor/mcp.json) (Read from a config file)

Fix

  1. Remove the server, or run it in a container or sandbox with limited access.
  2. Require approval for every call to it.

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.3, A.8.2

SOC 2 Trust Services Criteria: CC6.3, CC8.1

GDPR: Art. 32

High Some workDE-2

A server connects straight to a database

Why it matters

An agent with database access can read or change anything its credentials allow.

Evidence

postgres connects to a database (~/.cursor/mcp.json) (Read from a config file)

Fix

  1. Connect through a read-only account limited to the tables needed.
  2. Keep agents away from production databases.

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.12, A.5.14, A.5.34, A.8.12

SOC 2 Trust Services Criteria: C1.1, CC6.7

GDPR: Art. 5(1)(c), Art. 28, Art. 30, Art. 44

Medium Larger projectAT-1

Agent connections skip any central policy or log

Why it matters

Without a central point you cannot see, limit or stop what agents do.

Evidence

github connects directly (~/.claude.json) (Read from a config file)

playwright connects directly (~/.claude.json) (Read from a config file)

notion connects directly (~/.claude.json) (Read from a config file)

linear connects directly (~/.cursor/mcp.json) (Read from a config file)

postgres connects directly (~/.cursor/mcp.json) (Read from a config file)

context7 connects directly (~/.codeium/windsurf/mcp_config.json) (Read from a config file)

Fix

  1. Route agent connections through a gateway or proxy that applies policy and keeps a log.

Durin does this: Durin is a policy and audit point for every request routed through it. Book a demo

Mapped to

ISO/IEC 27001:2022 Annex A: A.8.15, A.8.16

SOC 2 Trust Services Criteria: CC7.2, CC7.3

GDPR: Art. 5(2)

Medium Some workDE-4

Company data goes to outside service providers

Why it matters

Each provider receives whatever the agent sends it and handles it under its own terms.

Evidence

notion sends data to mcp.notion.com (~/.claude.json) (Read from a config file)

linear sends data to mcp.linear.app (~/.cursor/mcp.json) (Read from a config file)

context7 sends data to mcp.context7.com (~/.codeium/windsurf/mcp_config.json) (Read from a config file)

Fix

  1. Check each provider's terms and data handling.
  2. Remove providers you do not use.

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.12, A.5.14, A.5.34, A.8.12

SOC 2 Trust Services Criteria: C1.1, CC6.7

GDPR: Art. 5(1)(c), Art. 28, Art. 30, Art. 44

Medium Some workSA-2

No central control over which servers agents can add

Why it matters

Anyone using this machine can connect an agent to a new system without review.

Evidence

Claude Code has no managed list of allowed or denied servers (Read from a config file)

Fix

  1. Deploy managed settings that allow or deny servers: managed-mcp.json or allowedMcpServers for Claude Code, requirements.toml for Codex.

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.9, A.5.10

SOC 2 Trust Services Criteria: CC6.1

GDPR: Art. 30

Low Some workAA-4

Servers offer tools that delete data

Why it matters

A mistaken or misused call can remove data that may not come back.

Evidence

playwright offers delete tools (~/.claude.json) (Read from a config file)

Fix

  1. Turn off delete tools you do not need and require approval for the rest.

Mapped to

ISO/IEC 27001:2022 Annex A: A.5.3, A.8.2

SOC 2 Trust Services Criteria: CC6.3, CC8.1

GDPR: Art. 32

Low Quick fixAT-4

Agent clients are not sending their activity to your monitoring

Why it matters

Without exported activity, incidents involving agents are hard to investigate.

Evidence

Claude Code exports no activity in the settings read (Read from a config file)

Fix

  1. Turn on the client's OpenTelemetry export to your monitoring system.

Mapped to

ISO/IEC 27001:2022 Annex A: A.8.15, A.8.16

SOC 2 Trust Services Criteria: CC7.2, CC7.3

GDPR: Art. 5(2)

By server

ServerClient Findings
context7WindsurfAgent connections skip any central policy or log
context7WindsurfCompany data goes to outside service providers
githubClaude CodeTools that change data are approved in advance
githubClaude CodeServers download new code each time they start
githubClaude CodeAgent connections skip any central policy or log
linearCursorServers download new code each time they start
linearCursorAgent connections skip any central policy or log
linearCursorCompany data goes to outside service providers
notionClaude CodeAgent connections skip any central policy or log
notionClaude CodeCompany data goes to outside service providers
playwrightClaude CodeTools that change data are approved in advance
playwrightClaude CodeServers download new code each time they start
playwrightClaude CodeA server lets agents run code or shell commands
playwrightClaude CodeAgent connections skip any central policy or log
playwrightClaude CodeServers offer tools that delete data
postgresCursorServers download new code each time they start
postgresCursorA server lets agents run code or shell commands
postgresCursorA server connects straight to a database
postgresCursorAgent connections skip any central policy or log

Inventory

Agent clients found
Claude Code, Cursor, Windsurf
MCP servers configured
6
Systems agents can reach
6
Systems agents can change
3 (2 more with tools the audit could not classify)
Credential types found in config files
None
Outside providers
mcp.notion.com, mcp.linear.app, mcp.context7.com

Scope and limits

What to do next

Use the findings and suggested fixes in the full report to choose what to address first. Confirm each flagged setting in the running AI tool before changing it.

4 config files read

The grade reflects the config files provided. We did not test your running AI tools or inspect their activity.

  • Review connections in vendor accounts and installed plugins. The audit does not inspect MCP servers loaded from an account, plugin or extension.
  • Confirm what agents are allowed to do. App-only settings, managed device policies, runtime options, saved approvals and per-agent permission rules are not inspected.
  • Check the installed client versions. The audit does not detect versions; it interprets supplied settings as current versions apply them.
  • Inspect each MCP server's live tool list. The audit does not connect to servers to confirm which tools they expose; config-based tool types come from its catalog and tool names.
  • Check server packages for known vulnerabilities. This run did not query package registries or vulnerability databases.

This is a risk signal from configuration and usage metadata, not a formal audit, certification or legal advice.