mcpwatch-mcp

The MCP server that audits other MCP servers. Run MCPWatch security scans from inside Claude Code / Cursor / Windsurf.

Part of MCPWatch.

Install

{
  "mcpServers": {
    "mcpwatch": {
      "command": "npx",
      "args": ["-y", "mcpwatch-mcp"]
    }
  }
}

Drop the above into your Claude Desktop / Cursor / Windsurf MCP config. Restart, and four new tools are available to the agent:

Tools

scan_directory

Run the 10 OWASP MCP Top 10 checks on a local directory.

scan_directory({ path: "/Users/me/code/my-mcp-server" })

Returns a grade (A–F), a 0–100 score, and per-finding evidence + remediation. Optionally returns a SARIF v2.1.0 document with sarif: true.

scan_github_repo

Fetch the latest scan for a public GitHub MCP repo from the MCPWatch crawler.

scan_github_repo({ owner: "oraios", repo: "serena" })

get_leaderboard

Pull the top N MCP servers from the live MCPWatch leaderboard, optionally filtered by grade.

get_leaderboard({ limit: 10, grade_filter: "A" })

get_badge_url

Get a ready-to-paste MCPWatch SVG grade badge for your README.

get_badge_url({ owner: "lazymac2x", repo: "mcpwatch" })

Why run this through an MCP server?

• The agent can audit an MCP before it suggests you install it — no manual CLI step
• Findings come back as structured text the agent can reason about
• SARIF output flows directly into the GitHub Security tab via the mcpwatch-action
• Zero extra configuration beyond the mcpServers entry

Example prompts

• "Before I install oraios/serena, scan it with mcpwatch."
• "Show me the top 5 grade-A MCP servers from the leaderboard."
• "What is the current MCPWatch grade of google-gemini/gemini-cli?"

License

MIT