Mcpwatch MCP Server

Audit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard. The mcpwatch mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 4 defined tools rather than through you.

What it actually does

When running as an MCP server, MCPWatch exposes the following tools to your AI agent:

Adding it to your client

mcpwatch-scanner on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

Its toolset

Everything the assistant can do here goes through one of these:

• scan_mcp_server — Scan a local MCP server by path — returns grade + per-check findings
• get_public_score — Fetch the live grade for any public MCP server by owner/repo slug
• list_leaderboard — Return the top/bottom N servers from the public leaderboard
• explain_check — Get a detailed explanation of any OWASP MCP Top 10 check by ID

Configuration

• Node.js 18+ - The MCP server under test must be locally accessible (for scan_mcp_server / CLI) - No API key required for public leaderboard lookups

Caveats

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the mcpwatch mcp server does with a few real requests.

When to reach for it

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Mcpwatch's toolset — scan_mcp_server, get_public_score, list_leaderboard and 1 more — is a fair guide to whether it matches your workflow. It is maintained by lazymac2x; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.