Claude MarketplacesSubmit
lazymac2x avatar

Mcpwatch

lazymac2x/mcpwatch

Gives Claude the ability to security audit any MCP server against the OWASP MCP Top 10 and return an A through F letter grade. Exposes four tools: scan_mcp_server runs 10 checks on a local server path looking for command injection, path traversal, SSRF, and prompt injection risks. get_public_score fetches live grades from the public leaderboard at mcpwatch.pages.dev. list_leaderboard returns top and bottom ranked servers, and explain_check details any of the 10 security tests. Also works as a CLI via npx mcpwatch-scanner or a GitHub Action that can gate CI/CD on minimum grade thresholds. Reach for this when vetting third party MCPs before adding them to your config or when you want to track security posture across the ecosystem.

tools
4
transport
STDIO
last updated
Apr 11, 2026
View on GitHub

Tools

4 tools

Public tool metadata for what this MCP can expose to an agent.

scan_mcp_serverScan a local MCP server by path — returns grade + per-check findings

Scan a local MCP server by path — returns grade + per-check findings

No parameter schema in public metadata yet.

get_public_scoreFetch the live grade for any public MCP server by owner/repo slug

Fetch the live grade for any public MCP server by owner/repo slug

No parameter schema in public metadata yet.

list_leaderboardReturn the top/bottom N servers from the public leaderboard

Return the top/bottom N servers from the public leaderboard

No parameter schema in public metadata yet.

explain_checkGet a detailed explanation of any OWASP MCP Top 10 check by ID

Get a detailed explanation of any OWASP MCP Top 10 check by ID

No parameter schema in public metadata yet.

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Readme

MCPWatch

npm License: MIT lazymac2x/mcpwatch MCP server

Have I Been Pwned for MCP servers. Open-source security scanner that audits MCP servers against the OWASP MCP Top 10 and produces an A–F letter grade.

Overview

MCPWatch is a security tool for the MCP ecosystem that:

  • Runs 10 automated checks derived from the OWASP MCP Top 10 on any MCP server
  • Produces an A–F letter grade with per-check findings
  • Exposes an MCP server interface so AI agents can audit MCPs on demand
  • Provides a CLI for pre-install scanning in CI/CD pipelines
  • Powers a public leaderboard at mcpwatch.pages.dev with live SVG grade badges

Installation

Use with Claude Code / Cursor / Windsurf (MCP server)

Add to your MCP configuration:

{
  "mcpServers": {
    "mcpwatch": {
      "command": "npx",
      "args": ["-y", "mcpwatch-mcp"]
    }
  }
}

View the full README on GitHub

Details

Repository
github.com/lazymac2x/mcpwatch
Category
Security & Pentesting
Package
mcpwatch-mcp
Transport
STDIO
Registry
MCP registry, active

More from lazymac2x

Related Security & Pentesting MCP servers

View all
1neuralegion avatarBright Securityneuralegion/mcpAI-powered application security testing — scan APIs, discover endpoints, and find vulnerabilities.0stars
2gongrzhe avatarGmailgongrzhe/gmail-mcp-serverProvides Gmail integration with auto authentication, enabling email send, read, search, label management, and batch operations via MCP.1.1Kstars
3sirkirby avatarUniFi Network MCPsirkirby/unifi-mcpManage UniFi Network devices, clients, firewall, VLANs, VPNs, and more via MCP.420stars
4antonpk1 avatarTiny Cryptographyantonpk1/gibber-mcpTiny MCP server with cryptography tools, sufficient to establish end-to-end encryption between LLM agents211stars
5mustachecase avatarzanadirmustachecase/zanadirFind what a repository's CI is missing, and which security checks cannot fail the build.181stars
6bx33661 avatarWireshark Mcpbx33661/wireshark-mcpProfessional network analysis with tshark. Security audits, deep-dives, and threat detection.137stars