WoW Server MCP (timoinglin/wow-server-mcp) is an MCP server listed on the M8ven Trust Index. It scores 73 out of 100, grade C. It declares 82 tools. No publisher has claimed this listing.

C
Caution
73/100

WoW Server MCP

A local MCP server that lets any MCP-compatible AI client manage a standalone World of Warcraft private server, including server control, database operations, NPC/quest/loot management, and more.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

timoinglin

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — discover_schema (line 122: fs.writeFileSync(outputPath, outputJson))
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes82 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

read_server_config

Read a server config file. Allowed: config.json, worldserver.conf, authserver.conf, my.ini, my.cnf

write_server_config

Write/overwrite entire server config file. Use update_conf_value for single settings.

get_conf_value

Get a specific Key=Value setting from a .conf file

update_conf_value

Update a specific Key=Value setting in a .conf file in-place. Restart server for changes to take effect.

list_allowed_files

List all files the MCP server can read/write

create_account

Create a new game account with username and password via RA command (.account create). The account can then log in to the game.

set_gm_level

Set the GM (Game Master) security level for an account. Levels: 0=Player, 1=Moderator, 2=GameMaster, 3=Admin, 4+=Higher admin levels. Max level is 9.

set_account_password

Change an account's password via RA command.

modify_dp

Modify the Donation Points (DP / Battle Pay balance) for an account. This is the 'dp' column in the auth.account table used for the in-game store.

add_dp

Add Donation Points (DP) to an account's balance. Use negative values to subtract.

list_accounts

List all game accounts from the auth database. Shows ID, username, GM level, DP, email, and last login.

get_account_characters

List all characters belonging to a specific account.

get_config

Read the current MCP server config.json (database connection, RA settings, server paths)

update_config

Update specific fields in config.json. Pass a JSON object with the fields to update (supports deep merge). Example: {"database": {"password": "newpass"}}

reset_config

Reset config.json to the default values from example.config.json

db_query

Execute a SELECT query on the specified database (auth, characters, or world). Returns rows as JSON. Use parameterized queries with ? placeholders.

db_insert

Insert a row into a table. Provide the table name, column names, and values.

db_update

Update rows in a table. Provide SET clause values and WHERE conditions.

db_delete

Delete rows from a table. ALWAYS requires a WHERE clause for safety.

db_execute

Execute raw SQL on a database (for DDL, complex queries, multi-table joins, etc). Use with caution.

db_test_connection

Test database connectivity to auth, characters, and world databases

create_db_backup

Create a backup of the database(s) using mysqldump. Supports full database backups or specific tables with WHERE clauses (e.g. for backing up a specific account).

get_smart_scripts

Fetch SmartAI rules for a given source (creature / gameobject / quest / etc.) from the `smart_scripts` table, with human-readable event_type and action_type names. Use this BEFORE filing a 'broken gossip / missing menu' bug — SmartAI event 62 (GOSSIP_SELECT) or 64 (GOSSIP_HELLO) handlers on the sour

inspect_creature

Full deep-dive on a creature: template (name, flags, ScriptName, gossip_menu_id), quest starter/ender rows, vendor item count, smart_scripts summary, spawn count, and creature_loot_template summary. Combines ~6-8 queries you'd otherwise run by hand. Use this as the FIRST step when investigating any

inspect_gossip_chain

Trace a gossip menu fully: the gossip_menu row (text_id), every option in gossip_menu_option, the existence status of each option's action_menu_id (including magic GOSSIP_OPTION_* sentinels like 1048576 = BATTLEFIELD queue), every NPC that uses this menu (via creature_template.gossip_menu_id), and a

find_orphan_refs

Generic foreign-key integrity sweep. Finds rows in `source_table.source_column` that point to a value not present in `target_table.target_column`. Use this for systematic bug-hunting: quest_objective→item_template, creature_loot_template→item_template, gossip_menu_option.action_menu_id→gossip_menu,

check_scriptname

Search the configured worldserver core source tree (config.core_source_path) for a ScriptName string. Returns the files + line numbers where the script is registered (and a not-found warning if absent). Use this whenever a creature/gameobject has a non-empty ScriptName before claiming its DB-level b

inspect_loot_table

Inspect any loot table row (creature_loot_template, gameobject_loot_template, item_loot_template, reference_loot_template, etc.) for an entry, classifying each row as: valid item drop / currency (negative ID) / reference (negative mincountOrRef) / missing item. Use this BEFORE claiming a chest/mob '

search_creature_template

Search NPCs/creatures by name or entry ID in the world database. Returns matching creature templates.

get_creature_template

Get full creature template data by entry ID from the world database.

update_creature_template

Update specific fields on a creature template. After updating, use RA '.reload creature_template' to apply in-game.

search_quest_template

Search quests by name or ID in the world database.

get_quest_template

Get full quest data by ID from world database.

update_quest_template

Update fields on a quest template. Use RA '.reload quest_template' to apply.

search_item_template

Search items by name or entry ID in the world database.

get_item_template

Get full item data by entry ID.

update_item_template

Update fields on an item template. Use RA '.reload item_template' to apply.

search_gameobject_template

Search gameobjects by name or entry ID in the world database.

get_server_info

Get server uptime and player count via RA '.server info' command.

get_online_players

List currently online players from the characters database.

get_db_stats

Get database statistics: table counts, approximate row counts, and database sizes.

get_creature_loot

List all loot entries for a creature from 'creature_loot_template'. Shows item name, drop chance, and quantity range.

add_creature_loot_item

Add an item drop to a creature's loot table ('creature_loot_template'). Use negative chance for quest-only drops.

remove_creature_loot_item

Remove an item from a creature's loot table ('creature_loot_template').

search_loot_by_item

Find which creatures drop a specific item. Searches 'creature_loot_template' and shows creature names.

get_item_loot

Get loot contents of an item (e.g. lockboxes, bags) from 'item_loot_template'.

search_spell

Search spells by name in the 'spell_dbc' table. Useful when designing quests (spell cast objectives) or assigning auras to NPCs.

get_world_events

List world events from the 'game_event' table (Hallow's End, Brewfest, etc.) with active status.

search_teleport_location

Search teleport locations from 'game_tele'. Useful for finding coordinates when placing NPCs or testing quests in-game.

spawn_creature

Spawn a creature by template entry via RA '.npc add <entry>'. The creature spawns at the position of the GM character currently selected in the worldserver console (RA has no per-call player context). A GM must be in-game at the desired location.

delete_creature_spawn

Delete a specific creature spawn by GUID via RA '.npc delete'. The GM must target the creature in-game, or provide the GUID.

get_creature_spawns

List all spawns (instances) of a creature template entry in the world, from the 'creature' table. Shows GUID, map, coordinates, and spawn time.

get_npc_vendor_items

List all items sold by an NPC vendor. Queries the 'npc_vendor' table.

add_npc_vendor_item

Add an item to an NPC's vendor list in 'npc_vendor'. Use '.reload npc_vendor' or restart to apply in-game.

remove_npc_vendor_item

Remove an item from an NPC's vendor list in 'npc_vendor'. Reloads the table in-game automatically.

set_npc_gossip_menu

Set the gossip_menu_id on a creature_template. Reloads creature_template in-game.

search_gossip_menu

Search gossip_menu and gossip_menu_option to see what text/options a menu has.

get_waypoints

List all waypoints for a creature's movement path from 'waypoint_data'. Path IDs are usually the creature GUID.

add_waypoint

Add a waypoint to a creature's movement path in 'waypoint_data'. The path_id is typically the creature's GUID.

delete_waypoints

Delete all waypoints for a creature path ID from 'waypoint_data'.

set_npc_flags

Set npcflag on a creature_template (e.g. make it a vendor, quest giver, trainer). Common flags: 1=Gossip, 2=QuestGiver, 16=Trainer, 128=Vendor, 4096=FlightMaster. Values can be combined (bitfield). Reloads template.

clone_creature_template

Duplicate an existing creature_template with a new entry ID. Great starting point for creating a new NPC based on an existing one.

start_mysql

Start the MySQL server using MySQL.bat. Will report if already running.

stop_mysql

Stop the MySQL server process (taskkill). Warning: will forcefully terminate the process.

restart_mysql

Restart MySQL server (stop then start). Wait a few seconds between stop and start.

start_authserver

Start the authserver (login server). Will report if already running.

stop_authserver

Stop the authserver process.

restart_authserver

Restart the authserver (stop then start).

start_worldserver

Start the worldserver (game server). Will report if already running.

stop_worldserver

Stop the worldserver process.

restart_worldserver

Restart the worldserver (stop then start).

get_server_status

Check if MySQL, authserver, and worldserver processes are currently running. Returns PID if running.

get_quest_relations

Show which NPCs and game objects offer (start) and finish a given quest. Queries creature_queststarter, creature_questender, gameobject_queststarter, gameobject_questender.

set_quest_giver

Assign an NPC as the quest starter (giver) for a quest. Inserts into creature_queststarter and reloads.

set_quest_ender

Assign an NPC as the quest ender (turn-in NPC) for a quest. Inserts into creature_questender and reloads.

remove_quest_relation

Remove an NPC from a quest starter or ender relationship.

create_quest

Insert a new quest_template row. Creates a basic quest with title, level range, type, and optional reward XP/money. Returns the new quest ID. Use update_quest_template to fine-tune objectives and rewards afterward.

delete_quest

Delete a quest_template by ID and remove all NPC quest relations for it. Use with caution.

get_quest_rewards

Show all reward items, choices, and currencies for a quest from quest_template.

ra_command

Send a single command to the worldserver via Remote Access (telnet). Examples: '.server info', '.account create test test', '.reload all', '.gm on', '.additem 49623 1', '.teleport <player> <location>', '.ban account <name> <time> <reason>'. The command should include the leading dot.

ra_command_batch

Send multiple RA commands in sequence. Stops on first error. Useful for bulk operations like reloading multiple tables or creating multiple accounts.

discover_schema

Discover tool that scans the connected world and auth databases to find the correct column names for the current repack/expansion. It uses fuzzy matching and outputs a suggested schema_override.json file that can be used to configure the MCP server for a different WoW patch.

// known CVEs in dependencies1 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highmysql2@3.20.0GHSA-3f6p-5ww8-9rcr

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

lowmysql2@3.20.0GHSA-rgwj-5xj2-c3m3

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

82/82 tools missing one or more hints — read_server_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); write_server_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_conf_value (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +79 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — discover_schema (line 122: fs.writeFileSync(outputPath, outputJson))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

79/82 tool handlers declare input schemas (96%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 1 high severity in production deps — mysql2@3.20.0 (high), mysql2@3.20.0 (low)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/timoinglin/wow-server-mcp?variant=verified)](https://m8ven.ai/mcp/timoinglin/wow-server-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: f23d5161b93f6f242dacca5fa65c46b6724597fc
code hash: 5fc9d67baef636f436e5f25fb849febb430f1c6cea3d4b6a69c1b88476ecb602
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client