MCP Observatory
Compare MCP servers by capabilities, dependencies and risk indicators.
- Astro
- TypeScript
- SQLite
- Node
- Semgrep
On this pageWhat it does
What it does
MCP servers can appear in several registries under different names. Comparing capabilities, source repositories and security information requires combining those listings.
MCP Observatory collects server listings, resolves duplicates to canonical records and runs static source analysis. The dashboard combines releases, a dependency graph, capability and permission analysis, composite risk scores and a live event stream. Access is through the website; no local installation is required.
Browsing and security analysis
The main dashboard shows KPIs, rankings and the event stream. A faceted browser filters servers by capabilities and permissions. Each server has tabs for overview, capabilities, dependencies, releases, activity and a security dossier. Maintainer profiles group information by maintainer.
The security section covers CVEs, risk rankings, supply-chain indicators, hijack targets, tool safety, capability drift, naming and impersonation, licences, abandonment, trends and code analysis results.
Collection and analysis
Ten pollers retrieve data from their respective sources. A supervisor staggers initial runs, handles exceptions and records outcomes, with exponential backoff. The public /feeds page shows collection status and the time of each source’s last successful run.
Identity resolution applies a fixed sequence: explicit overrides, cross-source repo_url matches, exact matches on source and normalised slug, then the fallback source:name. Listings from the same source that share a repository remain separate to preserve monorepo packages. Retired identifiers redirect with HTTP 301 so existing URLs remain usable.
Static code analysis runs in a separate sidecar. Semgrep uses a dedicated container to prevent heavy scans from stalling the worker’s event loop. Analysis is an enrichment step: the pipeline continues if the scanner is unavailable.
Capabilities
| Section | Available information |
|---|---|
| Dashboard | KPIs, rankings, live stream, graph and capabilities |
| Servers | Capability and permission filters, with per-server details |
| Graph | Dependencies and related servers, with node colour and size based on risk score |
| Security | CVEs, supply chain, hijack, drift, naming, licences, abandonment and trends |
| Maintainers | Maintainer index and profiles |
| Feeds | Public collection status for every poller |
| API | SSE stream, statistics, server lookup, batch requests and search |
Sources and methodology
Sources include npm, PyPI, GitHub, Smithery, the official MCP registry, mcp.so, a client registry and CVE feeds. Read /methodology for the collection and analysis pipeline, /colophon for the technology stack and /feeds for current source status.