MCP Watch CLI
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
- 139 ★ on the repository
- Last commit
Minimal access
Why this level
- The scanner reads source code and downloads repositories, but runs and modifies nothing.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/mcp-watchDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The scanner reads source code and downloads repositories, but runs and modifies nothing.
This is third-party code. Review the repository files before installing.
What it does
MCP Watch inspects the code of an MCP server before it is connected to an agent. The scanner reads a GitHub repository or a local folder and reports vulnerabilities across twelve categories: hardcoded keys and tokens, hidden instructions in tool descriptions, prompt and parameter injection, tool mutation after install, conversation exfiltration, ANSI escape tricks, protocol violations, weak input validation, spoofing of known services, dangerous data flows and excessive permissions. The report goes to the console or to JSON, and findings can be filtered by severity and category. A Docker image and ready GitHub Actions workflows cover CI use.
Who it is for. Developers choosing third-party MCP servers for their agents, and authors checking their own servers before release.
Good fit when
- Quick check of a third-party MCP server repository before installing it.
- A server author wants vulnerabilities flagged in every pull request.
- A team builds an internal list of vetted MCP servers.
- A JSON report is needed for a script or another agent to process.
Not a fit when
- A running server must be tested at runtime, since the scanner reads source code.
- A guarantee of no vulnerabilities is expected, which a clean report cannot give.
- The server is closed and its code cannot be read.
Example request
Scan this MCP server repository, show only high-severity findings and explain which ones need fixing before connecting it.Limitations
Analysis is static, so findings can be false positives and some attacks stay invisible. The last repository commit is from July 2026. Scanning a GitHub repository downloads its code to the machine running the tool. The scanner does not replace reviewing a server's permissions and behaviour: even a clean report does not prove safety. Compare results with the server documentation and verify findings by hand before drawing conclusions. The project is small and its detection rules are updated irregularly.
How to disable. Remove the package with `npm uninstall -g mcp-watch` or stop the container. The scanner leaves no background processes or agent settings behind.
FAQ
How do I scan a GitHub repository?
Run `mcp-watch scan https://github.com/user/mcp-server`. For a local folder use `mcp-watch scan-local /path/to/project`.
How do I get a JSON report?
Add `--format json`. Use `--severity` to set the level and `--category` to pick a category such as `credential-leak`.
Do I need Node.js installed?
No, not when running through Docker with `docker run --rm mcp-watch scan <url>`. The image is built from the repository.
Can the scanner run in CI?
Yes. The repository includes GitHub Actions workflows for dependency updates and security scanning.
Which threats does the scanner look for?
Twelve classes: keys and tokens in code, tool poisoning, prompt and parameter injection, tool mutation, conversation theft, ANSI tricks, protocol violations, weak input validation, service spoofing, dangerous data flows and excessive permissions.
Discussion
No questions or reviews yet.
Related
CLI toolsA scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
MCP Scanner
mcp-scanner
A scanner from Cisco AI Defense: checks MCP servers and their tools for threats with three engines, YARA rules, a model and the Cisco API
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| MCP Watch (this card) | no | 139 | |
| MCP Scanner | yes | 1,109 | audits the `.claude` folder and agent configuration; MCP Watch reads the source code of the MCP server itself |
| Skill Scanner | no | 2,695 | scans skills and configurations against a rule set; MCP Watch checks a server repository across twelve threat classes |
README in short
Installation has three routes: an npm package, source code and Docker. The `scan` and `scan-local` commands accept an output format, a severity threshold and a category.