WoW Server MCP (timoinglin/wow-server-mcp) is an MCP server listed on the M8ven Trust Index. It scores 73 out of 100, grade C. It declares 82 tools. No publisher has claimed this listing.
A local MCP server that lets any MCP-compatible AI client manage a standalone World of Warcraft private server, including server control, database operations, NPC/quest/loot management, and more.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
timoinglin
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
read_server_configRead a server config file. Allowed: config.json, worldserver.conf, authserver.conf, my.ini, my.cnf
write_server_configWrite/overwrite entire server config file. Use update_conf_value for single settings.
get_conf_valueGet a specific Key=Value setting from a .conf file
update_conf_valueUpdate a specific Key=Value setting in a .conf file in-place. Restart server for changes to take effect.
list_allowed_filesList all files the MCP server can read/write
create_accountCreate a new game account with username and password via RA command (.account create). The account can then log in to the game.
set_gm_levelSet the GM (Game Master) security level for an account. Levels: 0=Player, 1=Moderator, 2=GameMaster, 3=Admin, 4+=Higher admin levels. Max level is 9.
set_account_passwordChange an account's password via RA command.
modify_dpModify the Donation Points (DP / Battle Pay balance) for an account. This is the 'dp' column in the auth.account table used for the in-game store.
add_dpAdd Donation Points (DP) to an account's balance. Use negative values to subtract.
list_accountsList all game accounts from the auth database. Shows ID, username, GM level, DP, email, and last login.
get_account_charactersList all characters belonging to a specific account.
get_configRead the current MCP server config.json (database connection, RA settings, server paths)
update_configUpdate specific fields in config.json. Pass a JSON object with the fields to update (supports deep merge). Example: {"database": {"password": "newpass"}}
reset_configReset config.json to the default values from example.config.json
db_queryExecute a SELECT query on the specified database (auth, characters, or world). Returns rows as JSON. Use parameterized queries with ? placeholders.
db_insertInsert a row into a table. Provide the table name, column names, and values.
db_updateUpdate rows in a table. Provide SET clause values and WHERE conditions.
db_deleteDelete rows from a table. ALWAYS requires a WHERE clause for safety.
db_executeExecute raw SQL on a database (for DDL, complex queries, multi-table joins, etc). Use with caution.
db_test_connectionTest database connectivity to auth, characters, and world databases
create_db_backupCreate a backup of the database(s) using mysqldump. Supports full database backups or specific tables with WHERE clauses (e.g. for backing up a specific account).
get_smart_scriptsFetch SmartAI rules for a given source (creature / gameobject / quest / etc.) from the `smart_scripts` table, with human-readable event_type and action_type names. Use this BEFORE filing a 'broken gossip / missing menu' bug — SmartAI event 62 (GOSSIP_SELECT) or 64 (GOSSIP_HELLO) handlers on the sour…
inspect_creatureFull deep-dive on a creature: template (name, flags, ScriptName, gossip_menu_id), quest starter/ender rows, vendor item count, smart_scripts summary, spawn count, and creature_loot_template summary. Combines ~6-8 queries you'd otherwise run by hand. Use this as the FIRST step when investigating any …
inspect_gossip_chainTrace a gossip menu fully: the gossip_menu row (text_id), every option in gossip_menu_option, the existence status of each option's action_menu_id (including magic GOSSIP_OPTION_* sentinels like 1048576 = BATTLEFIELD queue), every NPC that uses this menu (via creature_template.gossip_menu_id), and a…
find_orphan_refsGeneric foreign-key integrity sweep. Finds rows in `source_table.source_column` that point to a value not present in `target_table.target_column`. Use this for systematic bug-hunting: quest_objective→item_template, creature_loot_template→item_template, gossip_menu_option.action_menu_id→gossip_menu, …
check_scriptnameSearch the configured worldserver core source tree (config.core_source_path) for a ScriptName string. Returns the files + line numbers where the script is registered (and a not-found warning if absent). Use this whenever a creature/gameobject has a non-empty ScriptName before claiming its DB-level b…
inspect_loot_tableInspect any loot table row (creature_loot_template, gameobject_loot_template, item_loot_template, reference_loot_template, etc.) for an entry, classifying each row as: valid item drop / currency (negative ID) / reference (negative mincountOrRef) / missing item. Use this BEFORE claiming a chest/mob '…
search_creature_templateSearch NPCs/creatures by name or entry ID in the world database. Returns matching creature templates.
get_creature_templateGet full creature template data by entry ID from the world database.
update_creature_templateUpdate specific fields on a creature template. After updating, use RA '.reload creature_template' to apply in-game.
search_quest_templateSearch quests by name or ID in the world database.
get_quest_templateGet full quest data by ID from world database.
update_quest_templateUpdate fields on a quest template. Use RA '.reload quest_template' to apply.
search_item_templateSearch items by name or entry ID in the world database.
get_item_templateGet full item data by entry ID.
update_item_templateUpdate fields on an item template. Use RA '.reload item_template' to apply.
search_gameobject_templateSearch gameobjects by name or entry ID in the world database.
get_server_infoGet server uptime and player count via RA '.server info' command.
get_online_playersList currently online players from the characters database.
get_db_statsGet database statistics: table counts, approximate row counts, and database sizes.
get_creature_lootList all loot entries for a creature from 'creature_loot_template'. Shows item name, drop chance, and quantity range.
add_creature_loot_itemAdd an item drop to a creature's loot table ('creature_loot_template'). Use negative chance for quest-only drops.
remove_creature_loot_itemRemove an item from a creature's loot table ('creature_loot_template').
search_loot_by_itemFind which creatures drop a specific item. Searches 'creature_loot_template' and shows creature names.
get_item_lootGet loot contents of an item (e.g. lockboxes, bags) from 'item_loot_template'.
search_spellSearch spells by name in the 'spell_dbc' table. Useful when designing quests (spell cast objectives) or assigning auras to NPCs.
get_world_eventsList world events from the 'game_event' table (Hallow's End, Brewfest, etc.) with active status.
search_teleport_locationSearch teleport locations from 'game_tele'. Useful for finding coordinates when placing NPCs or testing quests in-game.
spawn_creatureSpawn a creature by template entry via RA '.npc add <entry>'. The creature spawns at the position of the GM character currently selected in the worldserver console (RA has no per-call player context). A GM must be in-game at the desired location.
delete_creature_spawnDelete a specific creature spawn by GUID via RA '.npc delete'. The GM must target the creature in-game, or provide the GUID.
get_creature_spawnsList all spawns (instances) of a creature template entry in the world, from the 'creature' table. Shows GUID, map, coordinates, and spawn time.
get_npc_vendor_itemsList all items sold by an NPC vendor. Queries the 'npc_vendor' table.
add_npc_vendor_itemAdd an item to an NPC's vendor list in 'npc_vendor'. Use '.reload npc_vendor' or restart to apply in-game.
remove_npc_vendor_itemRemove an item from an NPC's vendor list in 'npc_vendor'. Reloads the table in-game automatically.
set_npc_gossip_menuSet the gossip_menu_id on a creature_template. Reloads creature_template in-game.
search_gossip_menuSearch gossip_menu and gossip_menu_option to see what text/options a menu has.
get_waypointsList all waypoints for a creature's movement path from 'waypoint_data'. Path IDs are usually the creature GUID.
add_waypointAdd a waypoint to a creature's movement path in 'waypoint_data'. The path_id is typically the creature's GUID.
delete_waypointsDelete all waypoints for a creature path ID from 'waypoint_data'.
set_npc_flagsSet npcflag on a creature_template (e.g. make it a vendor, quest giver, trainer). Common flags: 1=Gossip, 2=QuestGiver, 16=Trainer, 128=Vendor, 4096=FlightMaster. Values can be combined (bitfield). Reloads template.
clone_creature_templateDuplicate an existing creature_template with a new entry ID. Great starting point for creating a new NPC based on an existing one.
start_mysqlStart the MySQL server using MySQL.bat. Will report if already running.
stop_mysqlStop the MySQL server process (taskkill). Warning: will forcefully terminate the process.
restart_mysqlRestart MySQL server (stop then start). Wait a few seconds between stop and start.
start_authserverStart the authserver (login server). Will report if already running.
stop_authserverStop the authserver process.
restart_authserverRestart the authserver (stop then start).
start_worldserverStart the worldserver (game server). Will report if already running.
stop_worldserverStop the worldserver process.
restart_worldserverRestart the worldserver (stop then start).
get_server_statusCheck if MySQL, authserver, and worldserver processes are currently running. Returns PID if running.
get_quest_relationsShow which NPCs and game objects offer (start) and finish a given quest. Queries creature_queststarter, creature_questender, gameobject_queststarter, gameobject_questender.
set_quest_giverAssign an NPC as the quest starter (giver) for a quest. Inserts into creature_queststarter and reloads.
set_quest_enderAssign an NPC as the quest ender (turn-in NPC) for a quest. Inserts into creature_questender and reloads.
remove_quest_relationRemove an NPC from a quest starter or ender relationship.
create_questInsert a new quest_template row. Creates a basic quest with title, level range, type, and optional reward XP/money. Returns the new quest ID. Use update_quest_template to fine-tune objectives and rewards afterward.
delete_questDelete a quest_template by ID and remove all NPC quest relations for it. Use with caution.
get_quest_rewardsShow all reward items, choices, and currencies for a quest from quest_template.
ra_commandSend a single command to the worldserver via Remote Access (telnet). Examples: '.server info', '.account create test test', '.reload all', '.gm on', '.additem 49623 1', '.teleport <player> <location>', '.ban account <name> <time> <reason>'. The command should include the leading dot.
ra_command_batchSend multiple RA commands in sequence. Stops on first error. Useful for bulk operations like reloading multiple tables or creating multiple accounts.
discover_schemaDiscover tool that scans the connected world and auth databases to find the correct column names for the current repack/expansion. It uses fuzzy matching and outputs a suggested schema_override.json file that can be used to configure the MCP server for a different WoW patch.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
82/82 tools missing one or more hints — read_server_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); write_server_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_conf_value (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +79 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Descriptions match behaviour
1 tool describes read intent but its handler mutates — discover_schema (line 122: fs.writeFileSync(outputPath, outputJson))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
79/82 tool handlers declare input schemas (96%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 1 high severity in production deps — mysql2@3.20.0 (high), mysql2@3.20.0 (low)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/timoinglin/wow-server-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check