MCP.Market

Watchdog MCP server

by OxToF·io.github.OxToF/watchdog-mcp·v0.1.0
No reviews yet

Who can change a Solana program or EVM contract, dependency advisories, scans. Paid per call (x402).

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Watchdog yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Watchdog tools (8, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • dependency_advisories

    Use before adding or upgrading a dependency, or to triage a lockfile. Give lockfile_path (a Cargo.lock, package-lock.json or yarn.lock on disk, read locally) or the lockfile text, or a list of up to 100 packages. Rust crates go to Solana Watchdog (RustSec/OSV), npm packages to EVM Watchdog (GitHub/OSV). Only registry packages are checked; workspace and git dependencies are skipped. Costs $0.01 USD

  • evm_contract_control

    Use before approving a token, depositing into, or signing for a contract on Base or Robinhood Chain. Detects the proxy kind (EIP-1967 transparent, UUPS, beacon, legacy zeppelinos, EIP-1167 clone, diamond, EIP-7702), the live implementation, and follows the upgrade controller and owner to the end: one key, a Safe (threshold of owners), a timelock (delay). Sourcify verification for the address and t

  • get_scan_report

    Free. Returns the status of a scan started with scan_repo and, once done, its JSON report.

  • scan_repo

    Use before a release or an integration: scans a public GitHub repo for advisories on its exact pinned dependencies (split into what ships on-chain and what is tooling), build hygiene, and code leads for known bug classes with file:line. ecosystem 'solana' for Rust/Anchor programs, 'evm' for Solidity (Foundry/Hardhat). Costs $0.50 USDC (Solana or Base). Waits up to wait_seconds for the report; othe

  • solana_program_authority

    Use before signing a transaction for, or depositing into, a Solana mainnet program. Answers who can replace its code: immutable, a single key, a Squads v4 multisig (threshold, members and time lock read on-chain, the vault re-derived as proof), Squads v3 or SPL Governance; plus the last deploy date, OtterSec verified build, embedded security.txt and severity-ranked flags. Costs $0.05 USDC on Solan

  • watch_createwrite action

    Use to be told, for 30 days, when something you rely on changes: a Solana program (programId: authority, multisig rules, code upgrade, lost verification), an EVM contract (address + chain: new implementation, controller or owner, weaker Safe or timelock), or a lockfile (lockfile_path: any new advisory). Hourly checks; each change is POSTed to your https webhook, signed with x-watchdog-signature: s

  • watch_status

    Free. Lists what a watch has seen (also kept when the webhook was down), or cancels it with cancel: true.

  • watchdog_wallet

    Free. Shows which payment wallets this server is configured with (addresses only), the per-call cap, the session budget, what was spent, and the price of each tool.

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Watchdog compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,255 servers
Tools
8
the typical server has 7
Tools that change things
13%
typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 7 read · 1 change

Install Watchdog in Claude Code, Cursor or VS Code

Runs npx -y watchdog-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add watchdog-mcp -- npx -y watchdog-mcp
Add to Cursor

What the publisher says

From the Watchdog repository's README, as published. We do not edit it. Read it on GitHub

watchdog-mcp

An MCP server for Solana Watchdog and EVM Watchdog. It gives an agent the security checks it needs at the moment it decides: before signing for a program, before approving a contract, before adding a dependency. Each paid call costs cents in USDC and is paid automatically over x402, from a wallet you provide, within limits you set.

Results are checks, not audits.

Tools

An address that holds no program or contract is not charged. A dependency check is settled only once its answer exists.

Install

Claude Code:

claude mcp add watchdog \
  -e WATCHDOG_SOLANA_PRIVATE_KEY=<base58 key of a Solana wallet holding a little USDC> \
  -e WATCHDOG_EVM_PRIVATE_KEY=<hex key of a Base wallet holding a little USDC> \
  -- npx -y watchdog-mcp

Claude Desktop, Cursor and other clients (mcpServers JSON):

{
  "mcpServers": {
    "watchdog": {
      "command": "npx",
      "args": ["-y", "watchdog-mcp"],
      "env": {
        "WATCHDOG_SOLANA_PRIVATE_KEY": "…",
        "WATCHDOG_EVM_PRIVATE_KEY": "…",
        "WATCHDOG_BUDGET_USD": "5"
      }
    }
  }
}

From a clone of this repository, scripts/add-to-claude-code.sh does the Claude Code step for you: it reads the Solana key from the clipboard, checks it without printing it, and registers the server.

Both keys are optional. Without a key for a chain, its tools return the price and how to pay instead of an answer.

Use a dedicated wallet that holds only what you are willing to spend on checks. No SOL or ETH is needed: the x402 facilitator pays the network fee.

Configuration

What protects your wallet

Every payment is screened before anything is signed:

network. A server that asked to be paid elsewhere would be refused;

  • it must go to the Watchdog merchant wallet of that service, in USDC, on the expected
  • it must fit under the per-call cap and the remaining session budget;
  • scan and watch access tokens are only ever sent back to the Watchdog that issued them.

Keys never appear in tool output or errors, including when a key is malformed or of the wrong chain.

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Watchdog: common questions

Is Watchdog MCP server safe?
Mostly: it is graded B (83/100). Read the Watchdog safety report
How do I install Watchdog?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Watchdog need an API key?
Yes. The registry entry asks for WATCHDOG_SOLANA_PRIVATE_KEY, WATCHDOG_EVM_PRIVATE_KEY.
Is Watchdog maintained?
The last commit was 34 days ago (2026-10-01). The latest release is v0.1.0.
How does Watchdog compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,255 servers); tools 8 (the typical server has 7); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.