Log inSubmit server
Mcpwatch logo

Mcpwatch

Audits local MCP servers against 10 OWASP checks, returning an A–F grade, findings, public scores, and leaderboard data.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Mcpwatch

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcpwatch": {
      "command": "npx",
      "args": [
        "-y",
        "mcpwatch-scanner"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y mcpwatch-scanner

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 2d ago.

Overview

The mcpwatch MCP server lets AI agents audit local MCP servers against 10 OWASP MCP Top 10 checks. It returns an A–F grade with per-check findings, and can also retrieve public grades or leaderboard entries by repository slug. Use it before adding a local server to an MCP configuration or when reviewing publicly listed servers. Public leaderboard lookups require no API key, while local scans require the target server to be accessible on the machine.

Use cases

  • Scan a local MCP server before adding it to a client configuration
  • Review OWASP findings for an MCP server during development
  • Check a public server’s current grade by repository slug
  • Compare top or bottom entries on the public leaderboard
  • Explain a specific OWASP MCP Top 10 check

Key features

  • Ten OWASP MCP Top 10 security checks
  • A–F grades with per-check findings
  • Local server scanning by filesystem path
  • Public score lookup by owner and repository
  • Top and bottom leaderboard queries
  • OWASP check explanations

Tools4

What Mcpwatch lets your agent do. Expand a tool for its parameters.

Self-reported~79 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

9/9 checks healthy over the last 52d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 13d ago via OSV.dev · mcpwatch-scanner (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads64Package downloads in the last 30 days.
Last commit5mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed4Callable tools this server registers over MCP.

How Mcpwatch works

What the mcpwatch MCP server does

The mcpwatch MCP server audits MCP servers for security issues mapped to the OWASP MCP Top 10. Local scans produce an A–F grade and findings for each check. The checks cover command injection, path traversal, unauthenticated mutations, prompt injection in tool descriptions, SSRF, hardcoded secrets, filesystem scope, rate limits, vulnerable dependencies, and input schema validation.

Grades range from A to F. An A represents a score of 90–100 with no Critical or High findings. B covers 75–89 without Critical findings, while lower grades reflect Critical findings or more severe issues. The grading table describes C as 60–74, D as 40–59, and F as 0–39.

How it works

The mcpwatch MCP server exposes an MCP interface that an agent can call on demand. scan_mcp_server accepts a local MCP server path and returns its grade and per-check results. The scanner must be able to access the server locally; the repository lists Node.js 18 or newer as a requirement.

Public data is handled separately from local scanning. get_public_score looks up a public server by owner and repository slug, while list_leaderboard returns the top or bottom N entries from the public leaderboard. Public servers on Smithery, npm, and the official registry are scanned daily. explain_check provides more detail about an OWASP MCP Top 10 check identified by its ID.

Setup and configuration

Run the MCP server through npm using a standard stdio configuration:

config.json
{
  "mcpServers": {
    "mcpwatch": {
      "command": "npx",
      "args": ["-y", "mcpwatch-mcp"]
    }
  }
}

A separate CLI package can scan a path with npx mcpwatch-scanner /path/to/mcp-server. The project also provides a GitHub Action that can fail a CI job when a result falls below a selected grade.

Tools and capabilities

  • Scan a locally accessible MCP server and return an A–F grade with individual findings.
  • Retrieve the live public grade for an owner/repository pair.
  • List the highest- or lowest-ranked public servers.
  • Explain an individual OWASP MCP Top 10 check.
  • Review the ten checks covering code, input, access, network, secret, dependency, and resource-scope risks.

Limitations and notes

The local scan tools require a server path that is accessible from the machine running the MCP server. Public score and leaderboard lookups do not require an API key, but they depend on the available public leaderboard data. The documented MCP interface is intended for auditing; the material does not describe it as a remediation or vulnerability-fixing tool.

The mcpwatch MCP server also has a CLI and GitHub Action, but those are separate usage paths rather than additional MCP tools. The project is licensed under MIT.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Mcpwatch

mcpwatch is an MCP server that connects AI agents to local MCP server paths and a public leaderboard. Its main tools scan local servers, retrieve public grades, list top or bottom leaderboard entries, and explain OWASP MCP Top 10 checks. It returns A–F grades with findings for local scans.

Install it through an MCP client with `npx -y mcpwatch-mcp` as the command. Add that command and argument to the client’s MCP configuration. The documented setup applies to Claude Code, Cursor, and Windsurf, and requires Node.js 18 or newer.

Yes, mcpwatch works with Cursor through its standard MCP configuration. Define `mcpwatch` with the `npx` command and the `-y mcpwatch-mcp` arguments, then use the exposed tools to scan locally accessible servers or query public data.

Yes, it can scan a locally accessible MCP server before you add it to your configuration. Call `scan_mcp_server` with the server path to receive an A–F grade and per-check findings. The separate CLI can also scan a path before installation.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMcpwatch AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcpwatch?style=directory)](https://allmcps.com/mcp/mcpwatch)
HTML Embed
<a href="https://allmcps.com/mcp/mcpwatch"><img src="https://allmcps.com/api/badge/mcpwatch?style=directory" alt="Mcpwatch on AllMCPs" /></a>