# mcpwatch [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/lazymac2x/mcpwatch  
**GitHub Stars:** 0  
**npm Downloads (last month):** 64  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcpwatch

## Description
Audit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard.

## Tools
Capabilities this server exposes over MCP:

- **scan_mcp_server** — Scan a local MCP server by path — returns grade + per-check findings
- **get_public_score** — Fetch the live grade for any public MCP server by owner/repo slug
- **list_leaderboard** — Return the top/bottom N servers from the public leaderboard
- **explain_check** — Get a detailed explanation of any OWASP MCP Top 10 check by ID

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcpwatch": {
    "command": "npx",
    "args": ["-y","mcpwatch-scanner"]
  }
}
```

## Documentation

## What the mcpwatch MCP server does

The mcpwatch MCP server audits MCP servers for security issues mapped to the OWASP MCP Top 10. Local scans produce an A–F grade and findings for each check. The checks cover command injection, path traversal, unauthenticated mutations, prompt injection in tool descriptions, SSRF, hardcoded secrets, filesystem scope, rate limits, vulnerable dependencies, and input schema validation.

Grades range from A to F. An A represents a score of 90–100 with no Critical or High findings. B covers 75–89 without Critical findings, while lower grades reflect Critical findings or more severe issues. The grading table describes C as 60–74, D as 40–59, and F as 0–39.

## How it works

The mcpwatch MCP server exposes an MCP interface that an agent can call on demand. `scan_mcp_server` accepts a local MCP server path and returns its grade and per-check results. The scanner must be able to access the server locally; the repository lists Node.js 18 or newer as a requirement.

Public data is handled separately from local scanning. `get_public_score` looks up a public server by owner and repository slug, while `list_leaderboard` returns the top or bottom N entries from the public leaderboard. Public servers on Smithery, npm, and the official registry are scanned daily. `explain_check` provides more detail about an OWASP MCP Top 10 check identified by its ID.

## Setup and configuration

Run the MCP server through npm using a standard stdio configuration:

```json
{
  "mcpServers": {
    "mcpwatch": {
      "command": "npx",
      "args": ["-y", "mcpwatch-mcp"]
    }
  }
}
```

A separate CLI package can scan a path with `npx mcpwatch-scanner /path/to/mcp-server`. The project also provides a GitHub Action that can fail a CI job when a result falls below a selected grade.

## Tools and capabilities

- Scan a locally accessible MCP server and return an A–F grade with individual findings.
- Retrieve the live public grade for an owner/repository pair.
- List the highest- or lowest-ranked public servers.
- Explain an individual OWASP MCP Top 10 check.
- Review the ten checks covering code, input, access, network, secret, dependency, and resource-scope risks.

## Limitations and notes

The local scan tools require a server path that is accessible from the machine running the MCP server. Public score and leaderboard lookups do not require an API key, but they depend on the available public leaderboard data. The documented MCP interface is intended for auditing; the material does not describe it as a remediation or vulnerability-fixing tool.

The mcpwatch MCP server also has a CLI and GitHub Action, but those are separate usage paths rather than additional MCP tools. The project is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/mcpwatch/readme_