English Français العربية

io.github.lazymac2x/mcpwatch

Official registry Developer tools

Audit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package mcpwatch-mcp
Claude Code 
claude mcp add mcpwatch -- npx -y mcpwatch-mcp@0.1.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "mcpwatch": {
            "command": "npx",
            "args": [
                "-y",
                "mcpwatch-mcp@0.1.1"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. MCPWatch
  2. Overview
  3. Installation
  4. MCP Tools
  5. The 10 Checks (OWASP MCP Top 10)
  6. Grading
  7. Public Leaderboard & Badges
  8. Architecture
  9. Requirements
  10. License
  11. Contributing
  12. Pro Report $49 (in development)
  13. Related — Lumen API + MCP Catalog

MCPWatch

Have I Been Pwned for MCP servers. Open-source security scanner that audits MCP servers against the OWASP MCP Top 10 and produces an A–F letter grade.

Overview

MCPWatch is a security tool for the MCP ecosystem that:

  • Runs 10 automated checks derived from the OWASP MCP Top 10 on any MCP server
  • Produces an A–F letter grade with per-check findings
  • Exposes an MCP server interface so AI agents can audit MCPs on demand
  • Provides a CLI for pre-install scanning in CI/CD pipelines
  • Powers a public leaderboard at mcpwatch.pages.dev with live SVG grade badges

Installation

Use with Claude Code / Cursor / Windsurf (MCP server)

Add to your MCP configuration:

{
  "mcpServers": {
    "mcpwatch": {
      "command": "npx",
      "args": ["-y", "mcpwatch-mcp"]
    }
  }
}
CLI (scan before install)
npx mcpwatch-scanner /path/to/mcp-server
GitHub Action (CI/CD gate)
- uses: lazymac2x/mcpwatch-action@v1
  with:
    path: .
    fail-below: B

MCP Tools

When running as an MCP server, MCPWatch exposes the following tools to your AI agent:

ToolDescription
scan_mcp_serverScan a local MCP server by path — returns grade + per-check findings
get_public_scoreFetch the live grade for any public MCP server by owner/repo slug
list_leaderboardReturn the top/bottom N servers from the public leaderboard
explain_checkGet a detailed explanation of any OWASP MCP Top 10 check by ID
Example: scan before adding an MCP

Ask Claude: "Use mcpwatch to scan the filesystem-mcp server at ~/mcps/filesystem-mcp before I add it to my config."

The 10 Checks (OWASP MCP Top 10)

IDCheckSeverity
MCP-01Command injection in tool handlersCritical
MCP-02Path traversal in file toolsCritical
MCP-03Unauthenticated mutationsCritical
MCP-04Prompt injection via tool descriptionsHigh
MCP-05SSRF in URL-fetching toolsHigh
MCP-06Hardcoded secret leakageHigh
MCP-07Over-permissive filesystem scopeMedium
MCP-08Missing rate limitsMedium
MCP-09Outdated dependencies with known CVEsMedium
MCP-10Missing input schema validationLow

Grading

GradeScore
A90–100 — no Critical/High findings
B75–89 — no Critical findings
C60–74 — has Critical findings, minor impact
D40–59 — multiple Critical findings
F0–39 — severe/exploitable vulnerabilities

Public Leaderboard & Badges

Every public MCP server on Smithery, npm, and the official registry is scanned daily.

Live badge — drop into any README:

[![MCPWatch score](https://api.lazy-mac.com/mcpwatch/badge/YOUR_OWNER/YOUR_REPO.svg)](https://mcpwatch.pages.dev/servers/YOUR_OWNER/YOUR_REPO)

JSON API:

GET https://api.lazy-mac.com/mcpwatch/scan/{owner}/{repo}

Architecture

mcpwatch/
├── packages/
│   ├── scanner/   # Core check engine (TypeScript, runs in Worker + CLI + Node)
│   └── cli/       # mcpwatch-scanner — npx runnable
├── workers/
│   └── crawler/   # CF Worker — scheduled crawl + scan (daily)
├── apps/
│   └── web/       # CF Pages — mcpwatch.pages.dev — public leaderboard
└── .github/
    └── workflows/ # mcpwatch-action CI gate

Requirements

  • Node.js 18+
  • The MCP server under test must be locally accessible (for scan_mcp_server / CLI)
  • No API key required for public leaderboard lookups

License

MIT — use it, fork it, contribute checks.

Contributing

Pull requests for new checks, false-positive fixes, or leaderboard improvements are welcome. See CONTRIBUTING.md for guidelines.

Pro Report $49 (in development)

Cross-repo trend analysis + Slack/Discord webhook alerts on grade drops + private MCP scanning. Email waitlist:

If you ship MCP servers, you might want these (one-time license, lifetime updates, MIT source):

Full catalog: https://api.lazy-mac.com Profile: https://github.com/lazymac2x dev.to: https://dev.to/lazymac2x

Frequently asked questions

What is io.github.lazymac2x/mcpwatch?

Audit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard.

How do I install io.github.lazymac2x/mcpwatch?

It runs on your machine. In Claude Code: claude mcp add mcpwatch -- npx -y mcpwatch-mcp@0.1.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.lazymac2x/mcpwatch need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.lazymac2x/mcpwatch open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.lazymac2x/mcpwatch?

It is published by lazymac2x. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.