wowaudit-mcp-server

MCP server for the documented WoWAudit API. It exposes guild roster, raid planning, attendance, weekly activity, wishlists, loot history, and applications as structured tools for Raid Lens and other MCP clients.

The server uses stdio and @modelcontextprotocol/server 2.x. It serves the current MCP protocol and retains the SDK's legacy 2025-era initialize handshake for older clients. Every result includes native structuredContent plus the same JSON as a text block for clients that do not consume structured results.

Requirements

• Node.js 20 or newer.

• A WoWAudit team API key. A team administrator can copy it from the team's Settings > Team > API key field, or open https://wowaudit.com/api and select the team. WoWAudit does not currently expose a scoped read-only Public API key; this server enforces read-only access locally by default.

Related MCP server: wow-mcp

Setup

npm install

Create .env from .env.example, then set:

WOWAUDIT_API_KEY=your-team-api-key

Build the server:

npm run build

The API key is loaded lazily, so the MCP process can start and list tools without a configured key. API calls return a structured configuration error until the key is available.

MCP client configuration

Use the compiled entry point from an MCP client:

{
  "mcpServers": {
    "wowaudit": {
      "command": "node",
      "args": [
        "C:\\programming\\typescript\\wowaudit-mcp-server\\dist\\index.js"
      ]
    }
  }
}

The server resolves .env relative to its installed location, not the MCP client's working directory. Credentials may instead be supplied through the client's env configuration.

Security model

A WoWAudit team API key can access the team's entire environment. The server applies these safeguards:

• The key is sent only as an Authorization: Bearer header. It is never put in a URL, result, or error.

• Only documented /v1/ routes are available. There is no arbitrary HTTP tool.

• Write tools are not advertised or callable unless WOWAUDIT_ENABLE_WRITES=true. The HTTP client independently blocks mutation requests while disabled.

• Destructive delete tools additionally require confirm: true on each call.

• Application tools are disabled unless WOWAUDIT_ENABLE_APPLICATIONS=true because applications may contain identities, questionnaire answers, and uploaded-file URLs.

• Tool annotations identify read-only, idempotent, and destructive operations to modern MCP clients.

• Responses are limited to 2 MiB by default. Adjust WOWAUDIT_MAX_RESPONSE_BYTES only when necessary.

• GET responses are cached in process for 30 seconds. Successful writes clear the cache.

Enabling application tools does not provide channel authorization. A Discord integration must enforce officer-only access before exposing those tools. Similarly, a multi-guild bot must bind its trusted Discord guild ID to the correct WoWAudit credential outside model-controlled tool arguments.

Configuration

The default configuration exposes 11 non-sensitive GET tools. Setting WOWAUDIT_ENABLE_APPLICATIONS=true adds the two read-only application tools. Setting WOWAUDIT_ENABLE_WRITES=true adds mutation tools; leave it unset for a strictly read-only MCP surface.

Tools

Mutation tools shown below are only registered when WOWAUDIT_ENABLE_WRITES=true. Application tools are only registered when WOWAUDIT_ENABLE_APPLICATIONS=true.

Team and roster

Activity and attendance

Raids and signups

wowaudit_update_raid supports status and schedule changes, encounter enable/disable lists, signup statuses, comments, role/class overrides, selected status, and encounter-specific selections.

Wishlists and loot

The all-character wishlist and loot endpoints can be large. Prefer character-specific calls and use limit on collection tools where possible.

Applications

Applications are separately gated by WOWAUDIT_ENABLE_APPLICATIONS=true. Mutating them also requires WOWAUDIT_ENABLE_WRITES=true.

Result envelope

Successful tools return:

{
  "data": {},
  "meta": {
    "endpoint": "/v1/team",
    "method": "GET"
  }
}

Collection tools accepting limit additionally report totalItems, returnedItems, and truncated. The limit is applied after WoWAudit responds because the public API does not document server-side pagination.

Errors return isError: true, structured { "error": "..." }, and a text fallback. Upstream errors also include kind, HTTP status, and retryAfterSeconds when available.

Development

npm run dev
npm test

Tests compile the server, verify both modern and legacy protocol negotiation, inspect all tool schemas and annotations, exercise security gates, and test the HTTP client without using a real API key.

For a small live read-only check:

npm run test:live

The live smoke test calls team, period, roster, and raid-list endpoints. It never invokes application or write tools.

WoWAudit API caveats

• The public documentation defines no pagination or rate-limit contract.

• The documentation primarily supplies response examples rather than strict reusable schemas, so payload fields may evolve.

• The embedded documentation contains a development-looking server URL. This project uses the confirmed production origin https://api.wowaudit.com by default.

• WoWAudit accepts an API key in a query parameter, but this server deliberately uses only the authorization header to reduce credential leakage.

License

MIT, copyright WoWAudit MCP Server contributors.