Best for
- Development teams building custom MCP servers.
- Security teams needing to validate MCP server security in the AI supply chain.
- DevOps engineers looking for CI integration for MCP server testing.
M
MCP Observatory
Community
CI-native security testing for MCP servers: attack simulation, schema drift detection, and health scoring.
GitHub source repository ↗
51FMRS · D
MCP Observatory is a powerful security scanner and testing tool for MCP servers. It offers unique attack simulation and schema drift detection, and can act as an MCP server itself. This is a valuable tool for teams looking to integrate security testing into their MCP development workflow.
MCP Observatory is a CI-native security tool for testing custom MCP servers. It detects schema drift, simulates attacks, generates compliance evidence (e.g., SARIF reports), and provides health scoring before agents depend on your servers. It can run as a CLI or as an MCP server, allowing AI agents to directly test other MCP servers.
Tools
scan
Check if all your configured MCP servers are healthy.
check_server
Test a specific server before installing or after updating.
score_server
Get a quick health score and grade for a server.
record
Capture a baseline of a working server for future comparison.
replay
Test against a recorded session — no live server needed.
verify
Confirm a server update didn't break anything.
watch
Check a server and see what changed since the last check.
diff_runs
Find regressions between two check results.
get_last_run
Retrieve previous check results for a server.
suggest_servers
Discover MCP servers that match your project stack.
Setup
- Ensure Node.js 20 or later is installed.
- For CLI usage, run
npx @kryptosai/mcp-observatoryornpx @kryptosai/mcp-observatory demo. - To use as an MCP server, add a
mcpServersentry in your client config, e.g.,
{
"mcpServers": {
"mcp-observatory": {
"command": "npx",
"args": ["-y", "@kryptosai/mcp-observatory", "serve"]
}
}
}
- In Claude Code, use
claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve. - For CI, use
setup-ci --all --command "npx -y my-mcp-server" --sarifto generate a workflow.
claude_desktop_config.json
{
"mcpServers": {
"mcp-observatory": {
"command": "npx",
"args": [
"-y",
"@kryptosai/mcp-observatory",
"serve"
]
}
}
}
Fit and risk
Not for
- Servers requiring interactive OAuth (like Google Drive) that need pre-authentication.
- Servers using custom WebSocket transports (e.g., BrowserTools MCP) are not supported.
- Performance benchmarking of MCP servers (use MCPBench).
Required permissions
- Requires access to the local filesystem to read configs and write reports.
- Can spawn subprocesses to launch MCP servers.
- Can post GitHub comments and set commit statuses (when configured).
- Can upload SARIF results to GitHub Code Scanning (when configured).
Risks and side effects
- May execute unsafe tool calls, but has an allowlist for base commands by default.
- Requires network access to install npm packages and reach remote servers.
- Generated reports may contain sensitive information; handle them carefully.
Troubleshooting
- If a server times out, check the `timeoutMs` setting in the target config.
- If HTTP/SSE connections fail, verify the URL and authentication tokens.
- Ensure servers use standard transports (stdio, HTTP/SSE) and are pre-authenticated.
Use cases
Automatically detect regressions and schema drift in MCP servers within CI pipelines.
Perform security audits and attack simulations on MCP servers before deployment.
Generate health score badges for public MCP servers.
Record and replay MCP server sessions for offline testing.
Use MCP server mode to let AI agents automatically verify other MCP servers.
Supported clients
Claude DesktopFull support