Mcpwatch
Audit MCP servers from Claude Code with OWASP-oriented checks, letter grades, and leaderboard context before you ship agent tooling.
Overview
mcpwatch is a MCP server for the Ship phase that audits MCP servers with 10 OWASP checks, an A–F grade, and live leaderboard results from Claude Code.
What is this MCP server?
- 10 OWASP-aligned checks packaged for MCP server assessment from inside Claude Code.
- Letter-grade outcome (A–F) for quick pass/fail gut checks before adding servers to prod configs.
- Live leaderboard context for comparing audited MCP servers in the ecosystem.
- stdio npm package mcpwatch-mcp v0.1.1 for local MCP registration.
- Open-source repo at github.com/lazymac2x/mcpwatch with MCP schema 2025-12-11 metadata.
- 10 OWASP checks per audit
- A–F grading scale documented in server description
- npm package mcpwatch-mcp version 0.1.1 with stdio transport
What problem does it solve?
You are stacking MCP servers in your agent config with no structured way to see OWASP-style risks before they touch your codebase.
Who is it for?
Claude Code users curating multiple MCP servers who want a repeatable security audit with letter grades inside the agent loop.
Skip if: Teams that only need SAST on application code, full compliance attestations, or audits of non-MCP services.
What do I get? / Deliverables
After installing mcpwatch, you get graded audit output and leaderboard context so you can drop or harden risky servers before shipping.
- OWASP-oriented MCP audit results across 10 checks
- A–F security grade for each reviewed server
- Leaderboard-aware context to prioritize remediation
Recommended MCP Servers
Journey fit
How it compares
MCP-specific security auditor with 10 OWASP checks, not a cloud IAM scanner or generic dependency CVE bot.
Common Questions / FAQ
Who is mcpwatch for?
Solo builders and small teams shipping with Claude Code who install several MCP servers and need OWASP-oriented audits with A–F grades.
When should I use mcpwatch?
Use it in Ship security whenever you add, upgrade, or recommend MCP servers—before promoting configs to daily driver or client-facing setups.
How do I add mcpwatch to my agent?
Install npm package mcpwatch-mcp at version 0.1.1, register the stdio MCP server in Claude Code, then run audit flows against target MCP servers from the tool list.