# MCP Observatory

A CI-native security scanner for MCP servers that simulates attacks, detects schema drift, and produces a health score and compliance evidence before other agents come to depend on the server.

MCP Observatory is a security-testing tool for teams building their own MCP servers, meant to run during development and in continuous integration to catch problems before agents come to rely on a server in production. Running it against a project scans a configured MCP server, or an included example when none is configured, and reports a target, a grade, specific findings, and a saved receipt of the scan.

Findings are framed as issues to review rather than a paywall: local scans and local CI use stay free, including a hosted GitHub Action for scanning in CI and generating SARIF output for code scanning. An optional hosted snapshot upload adds a dashboard, with a free tier covering one target, the latest snapshot, seven-day retention, and ten uploads a month, and a paid individual tier for more targets and longer history. A companion tool can enforce the scan results at runtime by blocking dangerous tool calls. Telemetry collection is disclosed and can be inspected or disabled.

Website: https://github.com/KryptosAI/mcp-observatory