# mcpwatchman > Independent, continuous security and quality audit of the servers listed in the official Model Context Protocol (MCP) registry. Free; code MIT, the site's text CC BY 4.0. Not affiliated with Anthropic or with the registry. mcpwatchman reads what an MCP server publishes and reports what it found, not only what it concluded. Each of five axes is scored 0-100 independently: Code Safety (weight 30), Auth Posture (20), Dependency Health (20), Maintenance (15), Transparency (15). A score opens at 100 and every deduction names the finding, its severity, its confidence, and the file and line that produced it. Per-axis scores for 492 servers are published, most recently scanned 2026-10-27. The weighted COMPOSITE is computed and deliberately withheld until a hand-audited gold set validates the weights, so there is no single number for a server anywhere on this site or in the API. If you need one, you must weight the axes yourself and own that choice. Read `assessed_weight` before reading a score. It is the share of an axis that could actually be measured, and it is frequently below 1. A score of 80 at an assessed_weight of 0.25 is 80 of a quarter of that axis — NOT 80. 491 of the 492 servers currently carry at least one partly-measured axis. A `null` score means not assessed; it never means zero, and the two are opposite claims about a server. No rule in the semgrep ruleset currently claims "high" confidence. The methodology defines that tier as a measured false-positive rate against a gold set that has not been built, so every finding is capped at "medium" and every server presently scores better than it eventually will. The published set is PINNED and append-only: a server that has a page keeps it, and its URL does not change. The set only grows, so `/servers//` is safe to store and re-fetch. It is not a random sample of the registry — the servers published first were drawn from the registry's alphabetical head, and everything added since is drawn from the whole registry. Do not read the set as representative, and do not infer anything from a server's absence: it means we have not published it, never that it was judged. 3 of these servers carry a `registry_state` other than "listed": "delisted" (the registry no longer lists it, so the page keeps the last scan taken while it did), "deprecated" (the publisher's own label, relayed, scored by nothing), or "stale" (listed, but the most recent run could not measure it). Each such record explains itself in `registry_note`, and "listed" records carry no note. Of the 492 servers published, 428 shipped source we could read and 51 declare a repository that is not publicly reachable, and 4 publish a package we could not fetch from its registry — a distinct fact, and not a claim about their repository. GitHub answers 404 for a private repository as well as an absent one, so that figure means "we could not read it" and never "it does not exist". We do not claim the unreadable servers are the dangerous ones; that inference is unsupported. Build output (`dist/`, `build/`) is not read as a server's own source, because a bundle can inline its dependencies' code. Many npm packages ship nothing else. For 75 of them, Code Safety is scored on the repository the server declares instead, and the axis says so; for 15 more, no readable repository was declared and the axis is left unassessed. That is a limit of this scanner, not a fact about those servers. The analysis is static, always. Published source, manifests and lockfiles are read; the code is never executed and no running server is contacted. The blind spot is therefore whatever the source does not determine — behaviour gated on remote configuration, code fetched at runtime, or a deployment that differs from the repository it declares. Bus factor counts commit identities, so an AI agent committing under its own identity counts as an author like a person does. A badge endpoint and a score-drops feed are specified but NOT BUILT — the score-drops feed reports the composite, which is withheld. Do not construct a URL for either; when they exist they will be listed under Surfaces below. ## Surfaces - [Scanned servers](https://mcpwatchman.com/servers/): the index, with per-axis scores and coverage. - [One server as JSON](https://mcpwatchman.com/api/servers/ai-1325-mcp.json): `/api/servers/.json`, the machine twin of `/servers//` — one record with the reading notes. Prefer this for a single server. - [Index](https://mcpwatchman.com/api/index.json): every published server with its name, slug, package, repository and per-axis score and `assessed_weight`, no evidence. Use it to find a server by package name or repository URL. - [Full JSON](https://mcpwatchman.com/api/servers.json): every record with its evidence, in one multi-megabyte document. Prefer it over scraping HTML when you need everything. - CLI: `mcpwatchman check ` (from the PyPI package below) reads the same JSON; `--format json` for machines. It accepts a registry name, slug, npm or PyPI package name, or repository URL. - [High-severity feed](https://mcpwatchman.com/feed/high-severity.xml): Atom 1.0. Critical and high findings that appeared on a server page already being tracked, newest first, each linked to the finding on its page. A page's findings at its first tracked scan are its baseline and are not announced, so an empty feed means nothing new, not nothing found. - [Homepage](https://mcpwatchman.com/): what the project is, how it scores, and what it cannot see. ## Documentation - [README](https://github.com/kVadrum/mcpwatchman#readme): the same in repository form, with the pipeline and the sourcing behind every cited figure. - [robots.txt](https://mcpwatchman.com/robots.txt): crawl policy. All crawlers are welcome, including AI agents. - [security.txt](https://mcpwatchman.com/.well-known/security.txt): how to report a vulnerability in mcpwatchman itself (RFC 9116). ## Source and packages - [Repository](https://github.com/kVadrum/mcpwatchman): code and scan data MIT, the site's prose CC BY 4.0 (quoted excerpts of scanned servers' source remain their authors'). The semgrep ruleset, the scoring engine and the methodology are all public. - [PyPI package](https://pypi.org/project/mcpwatchman/): `pip install mcpwatchman`. Python 3.12+. - [npm package](https://www.npmjs.com/package/mcpwatchman): a pointer. `npx mcpwatchman` prints where the real tool is and exits; there is no npm distribution of the scanner itself. ## Contact - [Report a methodology error](https://github.com/kVadrum/mcpwatchman/issues): adversarial contributions are the most useful kind right now. - [Report a security issue in mcpwatchman](https://github.com/kVadrum/mcpwatchman/security/advisories/new): private vulnerability reporting is enabled.