# mcp-observatory

Tests MCP servers for security vulnerabilities, simulates attacks, and detects schema drift in CI or local workflows before agent integration.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 135
- Author: KryptosAI
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/KryptosAI/mcp-observatory
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-observatory

## What it does

The tool inspects MCP server setups, checks tool definitions against schema drift, and outputs findings into HTML, JSON, or SARIF files. It can run automated checks inside GitHub Actions workflows or handle queries directly when started with the `serve` command.

A dedicated `protect` command updates client configuration files in Cursor, Claude, and VS Code to enforce default-deny rules. Remote HTTP and SSE endpoints remain untouched during this process. For active filtering during runtime, it connects with `mcp-seatbelt` to block unsafe tool executions through a proxy.

Node.js 20 or newer is mandatory for running the CLI through `npx`. Without Node.js 20+, execution stops immediately. Telemetry stays completely disabled by default and makes no remote calls without explicit confirmation.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory
```

### Codex

**Platform CLI**
```bash
codex mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp-observatory": {
            "command": "npx",
            "args": [
                "-y",
                "@kryptosai/mcp-observatory"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp-observatory": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@kryptosai/mcp-observatory"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mcp-observatory npx -y @kryptosai/mcp-observatory
```

## When to use it
- scan MCP server tools for flaws before agent deployment
- detect schema changes and simulate malicious tool calls
- generate SARIF vulnerability reports for GitHub Actions
- run a private local dashboard with audit logs

## Example prompts
- Run a security audit on my local MCP server and show any detected vulnerabilities.
- Generate a GitHub Actions workflow with SARIF reporting for this MCP server.
- Check my MCP client configurations and apply default-deny protection rules.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md