MCP Observatory: security testing for MCP servers
MCP Observatory
An MCP server scanner: checks schemas, drift and attack behavior, runs in CI and as an MCP server for agents
- 120 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- A check runs the target server and `scan deep` calls its tools: scan only servers you trust
- The `protect` command rewrites the configs of every MCP client it finds, so back the files up first
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/mcp-observatoryDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- A check runs the target server and `scan deep` calls its tools: scan only servers you trust
- The `protect` command rewrites the configs of every MCP client it finds, so back the files up first
This is third-party code. Review the repository files before installing.
What it does
MCP Observatory launches an MCP server, queries it, scores the result and saves a receipt: target, grade, findings and a file path. The checks catch broken tools, unsafe schemas, schema drift between versions, slow responses and common security footguns. It also offers attack simulation, record and replay of sessions for regression tests, and a 0 to 100 health score. The first run is `npx -y @kryptosai/mcp-observatory@latest`: it checks your first configured server or a bundled example. Results are reviewed locally: the `dashboard` command opens run history with HTML reports and JSON downloads, with no account and no upload. For teams there is a GitHub Action and a `setup-ci` command that create a workflow with pull request comments and a SARIF report for GitHub Code Scanning. The `serve` mode turns the tool into an MCP server so an agent can inspect other servers itself. The `source-audit` and `package-check` commands review code and package names without running them.
Who it is for. Authors and teams that ship their own MCP servers or install other people's and want to check them in CI and before connecting them to an agent.
Good fit when
- You write an MCP server and want to catch schema changes and broken tools in every pull request
- Before connecting someone else's server you need to check its package and code without running them
- In Claude Code you want a tool that lets the agent check installed servers itself
- You need a SARIF report on MCP servers for the GitHub Code Scanning tab
- You want to record a session with a server and replay it after updating dependencies
Not a fit when
- You need a safety guarantee: the author states the checks flag candidates for review and do not prove a server is safe
- You need to block dangerous calls at runtime: that takes the separate `mcp-seatbelt` and a policy on its side
- Your servers use HTTP and SSE: the `protect` command leaves such config entries untouched
Example request
Check every MCP server in my configuration with mcp-observatory and show the grade and findings for each.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
It needs Node.js 20 or newer. A check runs the target server, and `scan deep` also invokes safe tools to confirm they work, so scan only servers you trust to execute. Scanning a server on the host machine from the Docker image needs network access and a mounted directory.
The `protect` command rewrites the configs of every client it finds (Cursor, Claude, VS Code, `.mcp.json`) and `--undo` reverses it. HTTP and SSE servers are left alone.
Continuing in ClearFrame, a product from the same team, needs a separate account, and the Mac app is Apple Silicon only for now. Telemetry is off by default and enabled explicitly.
How to disable. Remove the server with `claude mcp remove mcp-observatory`. If you ran `protect`, restore client configs with `protect --undo`.
FAQ
How is it different from other MCP scanners?
Besides security checks it catches schema drift, records and replays sessions, gives a 0 to 100 health score, builds a public safety index and can run as an MCP server for an agent. The author compares it with the Snyk, Cisco and agent-shield scanners.
Is it paid?
No, every scanner feature, code audits, package-name review, receipts, record and replay, the dashboard and CI are open under MIT and work without an account. An account is only needed for ClearFrame products.
How do I connect it to an agent?
Run `claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve`. The agent then gets tools to check other servers.
How do I add it to CI?
Add the step `uses: KryptosAI/mcp-observatory/action@v1` or generate a workflow with `setup-ci --all --command "npx -y my-mcp-server" --sarif`.
Does it send data out?
Telemetry is off and makes no request until you opt in. You can preview the fields with `telemetry preview` and turn it on with `telemetry enable`. Run history stays local.
Discussion
No questions or reviews yet.
Related
MCP serversSecurity scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
ls-mcp finds MCP servers across Claude, Cursor and other editors, shows which are running and warns about keys in settings.
A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| MCP Observatory: security testing for MCP servers (this card) | no | not required | 120 | |
| MCP Scanner | yes | 1,117 | Cisco's scanner for threats in MCP servers without session record and replay | |
| Snyk Agent Scan | no | 3,235 | the Snyk scanner, without attack simulation or an MCP server mode |
README in short
The README follows three steps: a first run, reading the result and a local review with an optional move into ClearFrame. It then covers installation through npx, brew and Docker, the `protect` and `enforce` modes, the feature list, free tools for maintainers and a comparison with four other scanners.