Mcpwatch MCP server

by lazymac2x·io.github.lazymac2x/mcpwatch·v0.1.1

Audit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard.

B78/100grade B

What users say

No reviews yet

Safety scan

B78/100

Adoption

New

0 stars

Reviews

Nobody has reviewed Mcpwatch yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

get_badge_url
Return the URL of a live MCPWatch SVG grade badge for a GitHub repository. Drop this into any README to show the current MCPWatch grade.
get_leaderboard
Fetch the current MCPWatch leaderboard of public MCP servers ranked by security grade. Returns the most recently scanned set with per-repo grade, score, and finding count. Use this to pick a safe MCP server from a set of candidates.
scan_directorywrite action
Run the MCPWatch security scanner on a local directory. Returns a 0-100 score, A-F letter grade, and findings from the 10 OWASP MCP Top 10 checks (command injection, path traversal, SSRF, prompt injection via tool descriptions, unauthenticated mutations, secret leakage, over-permissive filesystem scopes, missing rate limits, outdated dependencies, missing input schema validation).
scan_github_repo
Fetch the latest MCPWatch scan result for a public GitHub repository from the live crawler. Use this when you want to audit an MCP server by its GitHub owner/repo name instead of cloning it locally. Returns the same grade + findings shape as scan_directory.

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan2 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 122 days ago8/15
Maintainer identityregistry namespace matches repository owner6/10

Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 78/100; higher than 57% of 48,255 servers
Tools: 4; the typical server has 7
Tools that change things: 25%; typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 3 read · 1 change

Runs npx -y mcpwatch-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcpwatch -- npx -y mcpwatch-mcp

Is Mcpwatch MCP server safe?: Mostly: it is graded B (78/100). Read the Mcpwatch safety report
How do I install Mcpwatch?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Mcpwatch need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Mcpwatch maintained?: The last commit was 160 days ago (2026-05-28). The latest release is v0.1.1.
How does Mcpwatch compare with other MCP servers?: safety score 78/100 (higher than 57% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 25% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.