Back to browse
GitHub Repository

Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as structured NDJSON. No code changes.

32 starsPython

MCP Python Hooks – sys.addaudithook and import hooks for MCP

by BlueRock-Jake·May 6, 2026·4 points·0 comments

AI Analysis

●●●BangerWizardryBig Brain

Zero-code runtime visibility for MCP servers using Python audit hooks is genuinely clever.

Strengths
  • Leverages sys.addaudithook to monitor transitive dependencies without code changes.
  • SHA-256 verification of every imported module prevents supply chain tampering.
  • Native support for MCP protocol events like session creation and tool calls.
Weaknesses
  • Audit hooks can introduce performance overhead in latency-sensitive applications.
  • Linux and macOS only; Windows support is missing from the current release.
Category
Target Audience

AppSec engineers and Python developers

Similar To

OpenTelemetry · Sysdig · Falco

Similar Projects