1. Validate your capture path with the built-in fixture
AgentSight v1.0.3 includes a minimal Python MCP fixture with echo, sum_numbers, and read_fixture tools over stdio and HTTP. The outputs are intentionally predictable. Run the fixture before a third-party audit so you know whether process attribution, stdio/network visibility, and the report path work in your environment. A broken baseline should be fixed before interpreting an empty production trace.
2. Record the protocol contract for the target tool
Capture the server/version, tool name, description, input schema, arguments, and returned tool result. The current MCP specification defines these protocol objects but also warns that tool annotations should be considered untrusted unless the server is trusted. The contract is the starting point for the audit, not proof of implementation behavior.
3. Exercise the smallest task that requires the target capability
Use one representative call with the minimum authority needed. Avoid a long interactive session that invokes multiple unrelated tools. Pin working directory, environment, configuration, and server version. A narrow task is what makes a child process, path, or destination attributable to the capability under review.
4. Compare the returned result with the process family
Inspect which executable handled the call and whether it delegated work to shell commands, Git, curl, package managers, interpreters, browsers, or other helpers. A server can return a small JSON result while performing substantial local work. Those descendants are not necessarily protocol violations; they are implementation facts the reviewer can compare with the expected capability.
5. Classify file and network effects before judging them
Separate expected project paths, runtime/configuration paths, caches/temp files, and unexplained external paths. Separate expected service endpoints, localhost, provider/package/source hosts, and unexplained destinations. Mark what is necessary for the task, what is surprising but plausible, and what requires reproduction or source review.
6. Repeat surprising effects and change one variable at a time
Re-run the same tool call to distinguish deterministic implementation behavior from unrelated background activity. Then change one input, permission, or configuration to test the hypothesis. A repeated unexplained effect tied to the same tool call is much stronger audit material than one event seen once in a busy workstation trace.
7. Publish the audit as a scoped compatibility/security result
Record the exact server and AgentSight versions, transport, task, relevant process/file/network findings, known capture limits, and commands needed to reproduce. Do not claim the entire server is safe because one capability behaved as expected, and do not claim a vulnerability merely because an implementation used a helper or cache that was not mentioned in its schema.
$ python3 docs/mcp-test/test_mcp_cli.py --transport stdio
$ python3 docs/mcp-test/test_mcp_server.py --transport http --host 127.0.0.1 --port 8765
$ sudo agentsight record -- <agent-command>
$ agentsight report audit --json