Watchgoose MCP

Watchgoose MCP connects MCP-capable AI clients to the Watchgoose Management API. It lets you inspect cron and recurring-task monitoring, with check changes available only when you explicitly enable writes.

Hosted connector

Use the hosted Streamable HTTP endpoint in clients that support OAuth 2.1 and Dynamic Client Registration:

https://mcp.watchgoose.com/mcp

In Claude, open Settings > Connectors and add the endpoint as a custom connector. For Claude Code, run:

claude mcp add --transport http --scope user watchgoose https://mcp.watchgoose.com/mcp

The browser consent flow limits each connection to one project and defaults to read-only access. See the Watchgoose MCP documentation for the tool and privacy boundaries.

Related MCP server: uptrack-mcp

Requirements

• Node.js 20 or later

• A project-scoped Watchgoose API key from Project settings

Use an hcr_ read-only key when you only need check state and status history. Use an hcw_ read-write key when you also need pings, integrations, or check changes.

Claude Desktop

Add this entry to claude_desktop_config.json and restart Claude Desktop:

{
  "mcpServers": {
    "watchgoose": {
      "command": "npx",
      "args": ["-y", "watchgoose-mcp"],
      "env": {
        "WATCHGOOSE_API_KEY": "hcr_your_project_key"
      }
    }
  }
}

Claude Code

claude mcp add --env WATCHGOOSE_API_KEY=hcr_your_project_key \
  --transport stdio --scope user watchgoose -- npx -y watchgoose-mcp

Run claude mcp get watchgoose to check the connection.

Cursor

Create .cursor/mcp.json in your project, or add the same entry to your user MCP configuration:

{
  "mcpServers": {
    "watchgoose": {
      "command": "npx",
      "args": ["-y", "watchgoose-mcp"],
      "env": {
        "WATCHGOOSE_API_KEY": "hcr_your_project_key"
      }
    }
  }
}

VS Code

Create .vscode/mcp.json:

{
  "servers": {
    "watchgoose": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "watchgoose-mcp"],
      "env": {
        "WATCHGOOSE_API_KEY": "hcr_your_project_key"
      }
    }
  }
}

Run MCP: List Servers and start watchgoose.

Environment

The server classifies key prefixes locally and never probes the API to infer access. Setting WATCHGOOSE_ENABLE_WRITES=true cannot give a read-only key additional access.

Tools

Checks are addressed by stable 40-character unique_key values. UUIDs, ping URLs, and integration UUIDs are used only inside the server and are not shown to the AI client.

Integration assignments use exact integration names. Names must be non-empty and unique within the project.

List results are capped at 100 checks, 100 pings, 200 flips, and 100 integrations. Every serialized tool result is also capped at 24,000 characters. Results include metadata when entries are omitted.

Security

• Writes are disabled by default, even with an hcw_ key.

• The API key is sent only in the X-Api-Key header and is never logged or returned.

• API redirects are rejected so credentials cannot be forwarded to another host.

• Check UUIDs, ping and update URLs, integration UUIDs, and unknown future API fields are removed from output.

• Pings keep only type, date, n, scheme, method, and duration. Source IP addresses, user agents, run IDs, and body URLs are removed.

• Ping bodies are never requested.

• The server has no telemetry.

Protect client configuration files that contain API keys. Prefer a dedicated project and the least-privileged key that exposes the tools you need. Revoke a key from Watchgoose project settings when it is no longer in use.

Development

npm install
npm run format:check
npm run lint
npm run typecheck
npm test
npm run publish:dry-run

Production integration tests are opt-in and require dedicated test-project keys. They never run in CI.

License

MIT