Log inSubmit server
MCP Observatory logo

MCP Observatory

by KryptosAI

Tests MCP servers for regressions, schema drift, security findings, capability changes, and CI readiness through a CLI or MCP interface.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Observatory

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "kryptosai-mcp-observatory": {
      "command": "npx",
      "args": [
        "-y",
        "@kryptosai/mcp-observatory@latest"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

KryptosAI/mcp-observatory scans MCP servers, invokes their tools, checks capabilities, identifies schema drift, and produces findings, receipts, reports, and CI outputs. It can discover servers from client configurations, run locally through npm, Homebrew, Docker, or an install script, and expose its functions in MCP server mode. Reach for it when validating a custom MCP server before release, adding regression checks to CI, reviewing security posture, or comparing behavior across versions. Local dashboards, history, evidence export, SARIF, GitHub workflow support, and optional remediation task preparation are included.

Use cases

  • Test a custom MCP server in CI before merging changes
  • Detect tool schema drift between server versions
  • Audit MCP server capabilities and security findings
  • Generate SARIF and receipts for review or compliance evidence

Key features

  • MCP server discovery from client configurations
  • Tool invocation and capability checks
  • Schema drift and regression detection
  • CI workflows, PR comments, and SARIF output
  • Local dashboards, reports, and MCP receipts
  • MCP server mode for inspecting other servers

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

8/8 checks healthy over the last 77d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · @kryptosai/mcp-observatory@latest (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars135Stargazers on the source repository.
npm downloads2.2kPackage downloads in the last 30 days.
Last commit6d agoMost recent push to the default branch.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Observatory works

What KryptosAI/mcp-observatory does

KryptosAI/mcp-observatory evaluates MCP servers as test targets rather than using them as application dependencies. It can inspect configured servers, connect to a selected command, enumerate capabilities, invoke tools, and report failures or security-related findings. Regression workflows cover compatibility, tool behavior, schema changes, record/replay/verify checks, and response timing.

Results include a target, grade, findings, and a saved receipt. Receipts package evidence, a verdict, an action, and reproduction commands. The project also supports risk graphs, health score badges, GitHub pull request comments, and normalized SARIF output for GitHub Code Scanning. An MCP server mode lets agents inspect other MCP servers directly.

How it works

Run the CLI against a configured server or pass a startup command explicitly. With no configured target, the first scan uses an included example. The scanner stores local history and can generate HTML reports and JSON downloads through its dashboard. audit supports profile-mapped checks such as nsa-mcp, while setup-ci --all can generate a complete CI workflow.

The project can also apply defensive controls around discovered servers. protect rewrites client configurations for a default-deny setup and supports undoing those changes; HTTP and SSE servers are left untouched. enforce --start-proxy creates a Seatbelt policy from scan results and starts the proxy. These controls are separate from the local scanning workflow.

Setup and configuration

Node.js 20 or newer and npm are supported on macOS, Windows, and Linux. The quickest installation runs the package directly:

Terminal
npx -y @kryptosai/mcp-observatory@latest

Other supported installation paths include Homebrew, Docker, and the repository's shell installer. Docker scans of host-local servers require network access and, when local files are involved, an appropriate volume mount and working directory.

To use the server through an MCP client, start its stdio mode with:

Terminal
npx -y @kryptosai/mcp-observatory@latest serve

CI can use the repository action or a generated workflow. A direct test looks like this:

Terminal
npx -y @kryptosai/mcp-observatory@latest test npx -y @modelcontextprotocol/server-everything

Telemetry is disabled by default. telemetry preview shows the fields, and telemetry enable opts in. Local scans, history, evidence export, and CI operation do not require a ClearFrame account; the optional clearframe command prepares a private instruction file and a read-only CLI command for review.

Tools and capabilities

  • Discover MCP servers from Claude and other supported client configuration locations.
  • Check server capabilities and invoke exposed tools.
  • Detect schema drift and run compatibility or regression checks.
  • Generate MCP receipts, reports, JSON exports, SARIF, and CI findings.
  • Record, replay, and verify MCP interactions.
  • Audit against a named profile, including nsa-mcp.
  • Review local scan history through a dashboard.
  • Produce risk graphs and action outcomes such as allow, gate, rerun, quarantine, or escalate.
  • Learn from explicitly integrated usage data, including sanitized invocation evidence, intent grouping, dissatisfaction flags, and regression-case export.

Limitations and notes

The clearframe workflow is optional and does not launch ClearFrame or upload evidence automatically. ClearFrame itself is currently available for Apple Silicon Mac, with separate account and usage terms. Usage learning requires an explicit local integration; observed execution and inferred breakdown signals are kept separate, and the review screen runs in a loopback-only browser context.

protect does not modify HTTP or SSE servers. The Docker workflow needs explicit access to the host network and local project files when scanning host-local targets. The project is free, open source, and MIT licensed.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Observatory

KryptosAI/mcp-observatory is an MCP server that connects to and inspects other MCP servers, exposing capabilities for scanning, auditing, tool invocation, regression testing, and schema-drift detection. It can run as a CLI or through MCP server mode, producing findings, receipts, reports, and CI-oriented evidence for server validation.

Install it by running `npx -y @kryptosai/mcp-observatory@latest`, or use Homebrew, Docker, or the repository's shell installer. Start MCP server mode with `npx -y @kryptosai/mcp-observatory@latest serve`. Node.js 20 or newer is supported.

Run the `test` command with the target server's startup command, such as `npx -y @kryptosai/mcp-observatory@latest test npx -y @modelcontextprotocol/server-everything`. The scan checks capabilities, invokes tools, records findings, and saves a receipt.

Yes, it can discover Cursor configuration and its `protect` command can rewrite discovered Cursor client configuration for default-deny operation. Start the tool with the package's `serve` command when connecting it as an MCP server.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Observatory AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/kryptosai-mcp-observatory?style=directory)](https://allmcps.com/mcp/kryptosai-mcp-observatory)
HTML Embed
<a href="https://allmcps.com/mcp/kryptosai-mcp-observatory"><img src="https://allmcps.com/api/badge/kryptosai-mcp-observatory?style=directory" alt="MCP Observatory on AllMCPs" /></a>