Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Hated WoW MCP

NPM · HATED-WOW-MCP · SCANNED SEP 20

MCP server for WoW addons: Lua API, Blizzard UI source, CVars, art lookup, linting, scaffolding.

Available components

68 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security88
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known medium-severity CVE affects fast-xml-parser 4.5.7, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 31 of 98 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 1 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability76
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2616 tokens (~130/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
  • Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 76% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Hated WoW MCP server?

Hated WoW MCP runs locally as an npm package, launched with npx -y hated-wow-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · hated-wow-mcp

# add to Claude Code
claude mcp add rdygaming-hated-wow-mcp -- npx -y hated-wow-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "rdygaming-hated-wow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "rdygaming-hated-wow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add rdygaming-hated-wow-mcp -- npx -y hated-wow-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rdygaming-hated-wow-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "hated-wow-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add rdygaming-hated-wow-mcp --command npx --arg -y --arg hated-wow-mcp
# ~/.hermes/config.yaml
mcp_servers:
  rdygaming-hated-wow-mcp:
    command: "npx"
    args: ["-y", "hated-wow-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "rdygaming-hated-wow-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add rdygaming-hated-wow-mcp -t stdio -c npx -a -y hated-wow-mcp
// mcp.json
{
  "mcpServers": {
    "rdygaming-hated-wow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +16
    • Malware scan: unverified → pass security
  • 19 Sept 26 0
    • Stability: unverified → 0.03 functional
    • Package version: 0.6.0 → 0.6.1 functional
  • 18 Sept 26 52

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/hated-wow-mcp@0.6.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-gh4j-gqv2-49f6 CVE-2026-41650 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 98 packages
Packages resolved 98
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 20 exposed · ~2,454 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
wow_addon_scaffold ~283

Generate a complete, working addon skeleton: .toc manifests for the chosen clients, an event-dispatch Core.lua with SavedVariables handling and a slash command, and optionally an XML frame template with its Lua mixin and a Settings-API options panel. Use this to start a new addon rather than writing boilerplate by hand. By default it only returns the files. With `write` it saves them into the addon folder, and it refuses if any of the files already exist unless `overwrite` is also set.

NameTypeReqDescription
authorstring
flavorsarrayClients to support. Defaults to retail only.
namestringyesAddon name; also the folder name.
notesstringOne-line description for the .toc and README.
overwritebooleanWith `write`, replace files that already exist. Off by default: scaffolding a name that matches an installed addon would otherwise silently replace its real files.
savedVariablesarray
slashCommandstringSlash command without the leading slash.
versionstring
withFramebooleanInclude an XML template and frame mixin.
withOptionsbooleanInclude a Settings API options panel.
writebooleanWrite the files into the configured addon folder instead of just returning them.

No output schema declared.

No examples provided.

wow_api_diff ~89

Check whether a function, event or type exists in each game client (retail, Classic progression, Classic Era, WoW Forever). Use this before writing code that has to run on more than one flavor, or to explain why something works on Classic but not retail.

NameTypeReqDescription
namestringyesFunction, event or type name, e.g. GetSpellInfo or C_Item.GetItemInfo.

No output schema declared.

No examples provided.

wow_api_event_search ~101

Search the events an addon can register with frame:RegisterEvent, and show each event's payload arguments in order. Use this whenever writing an OnEvent handler, so the argument list matches what the client sends.

NameTypeReqDescription
flavorstringGame client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
limitinteger
querystringyesEvent name or fragment, e.g. COMBAT_LOG or BAG_UPDATE.

No output schema declared.

No examples provided.

wow_api_search ~159

Search World of Warcraft's in-game Lua API — the functions an addon can call from inside the client. Covers namespaced functions (C_Item.GetItemInfo), legacy globals (UnitHealth), and widget methods (Frame:SetPoint). Results include full argument and return signatures. Use this before writing any addon code that calls the game.

NameTypeReqDescription
flavorstringGame client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
limitinteger
namespacestringRestrict to one namespace, e.g. C_Spell.
querystringyesFunction name or fragment. Matches exact names, prefixes, substrings and camel-hump abbreviations (GIIBID finds GetItemInfoByID).

No output schema declared.

No examples provided.

wow_api_stats ~51

Report which API index, UI source and game data sets this server has, when each was synced, and how large it is. Use this to confirm the data is present and current before relying on other tools.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wow_api_type_search ~113

Search the Enum.*, Constants.* and structure tables the in-game API uses — for example Enum.ItemQuality or the AuraData structure returned by C_UnitAuras. Searching for a member name finds the table that contains it.

NameTypeReqDescription
flavorstringGame client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
kindstringRestrict to one kind of table.
limitinteger
querystringyesType, enum, constant or member name.

No output schema declared.

No examples provided.

wow_atlas_search ~131

Search the named texture atlas elements the UI uses with SetAtlas, the modern way to reference Blizzard art, since an atlas name carries its own size and coordinates. Returns dimensions, the sheet FileDataID and the exact SetAtlas call. Prefer atlases over raw texture paths for UI art. Atlases differ between clients, so name the flavor you are writing for: an atlas that exists on retail may not exist on WoW Forever or Classic.

NameTypeReqDescription
flavorstringGame client. Defaults to retail.
limitinteger
querystringyesAtlas element name or fragment.

No output schema declared.

No examples provided.

wow_cvar_search ~146

Find the game's console variables — the settings behind SetCVar/GetCVar. Covers every CVar the client registers, and for the ones Blizzard's own UI touches, shows how it reads them, where, and what the options screen calls them. Use this before writing SetCVar, or to discover which CVar controls a piece of game behaviour.

NameTypeReqDescription
flavorstringGame client. Defaults to retail.
limitinteger
querystringyesCVar name or fragment, e.g. nameplate, cameraDistance.
usedOnlybooleanOnly CVars Blizzard's own UI reads or writes — the documented-by-example ones.

No output schema declared.

No examples provided.

wow_data_status ~55

Report which game data sets are synced — the file/FileDataID index and the texture atlas index — with counts and sync dates, and what to run for any that are missing. Use this when a game data lookup returns nothing.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wow_file_search ~176

Find game art and asset files by name, and get the FileDataID and texture path an addon needs to reference them. Covers every interface texture and icon (and models and maps when the full index is synced). A numeric query is treated as a FileDataID and resolved back to its path. Use this whenever writing SetTexture, SetNormalTexture or SetModel.

NameTypeReqDescription
extstringRestrict by extension, e.g. blp or m2.
includeNonInterfacebooleanSearch beyond interface/** — models, maps, sounds. Requires the full index.
limitinteger
querystringyesFile name fragment, or a numeric FileDataID to resolve.
understringRestrict to a path prefix, e.g. interface/icons/ or interface/buttons/.

No output schema declared.

No examples provided.

wow_icon_search ~104

Search the game's icon textures by name and return the path and FileDataID for each. Icons follow a naming convention (spell_fire_*, inv_sword_*, ability_warrior_*), so searching by theme works well. Use this to pick an icon for a button, an addon compartment entry, or a .toc IconTexture.

NameTypeReqDescription
limitinteger
querystringyesIcon name fragment, e.g. fireball, sword, warrior.

No output schema declared.

No examples provided.

wow_install_info ~51

Report the World of Warcraft installations found on this machine — their paths, flavors, build numbers, and the addons currently installed. Use this to confirm which client tools will target and to discover addon folders to lint.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wow_lua_lint ~159

Analyse addon Lua for problems specific to World of Warcraft: APIs that were removed or moved into a namespace in the target client, unknown events, taint (calling protected functions, overwriting Blizzard globals, touching secure frames in combat), and performance traps. Run this on any addon Lua before shipping it, and whenever porting between clients.

NameTypeReqDescription
codestringLua source to analyse.
disablearrayRule ids to suppress.
flavorstringTarget client. Defaults to retail.
knownGlobalsarrayGlobals defined elsewhere (embedded libraries, other files) — suppresses unknown-API warnings for them.
pathstringPath to a .lua file to analyse instead of inline code.

No output schema declared.

No examples provided.

wow_toc_validate ~124

Validate a .toc manifest: interface version against the target client, flavor suffix consistency, unrecognised directives the client silently drops, SavedVariables names, and files listed but missing (or present but unlisted). Run this whenever an addon fails to load or shows as out of date.

NameTypeReqDescription
fileNamestringFilename to assume when validating inline contents, e.g. MyAddon_Vanilla.toc.
pathstringPath to a .toc file, or to an addon folder.
tocstring.toc contents to validate.

No output schema declared.

No examples provided.

wow_ui_grep ~177

Regex-search the full Lua and XML source of the 348 Blizzard addons that ship with the client. This is the ground truth for how the game itself does something — event handling, secure frames, data providers, layout. Use it when the API reference tells you what a function is but not how it is meant to be used.

NameTypeReqDescription
contextintegerLines of surrounding context per hit.
extstringRestrict by file type.
flavorstringGame client. Defaults to retail.
ignoreCaseboolean
limitinteger
pathContainsstringRestrict to paths containing this.
patternstringyesJavaScript regular expression to search for.
pkgstringRestrict to one Blizzard package, e.g. Blizzard_ActionBar.

No output schema declared.

No examples provided.

wow_ui_list_packages ~79

List the Blizzard_* addon packages that ship with the client, optionally filtered. Use this to find which package owns a piece of the UI before grepping it, e.g. Blizzard_ActionBar for action buttons.

NameTypeReqDescription
filterstringSubstring filter on the package name.
flavorstringGame client. Defaults to retail.

No output schema declared.

No examples provided.

wow_ui_mixin_search ~106

Search the mixin tables Blizzard's UI uses — reusable method sets attached to frames via the XML mixin attribute or CreateFromMixins. Searching a method name finds the mixin that defines it. Use this to reuse Blizzard's behaviour or to understand what a template's methods do.

NameTypeReqDescription
flavorstringGame client. Defaults to retail.
limitinteger
querystringyesMixin name, fragment, or an exact method name.

No output schema declared.

No examples provided.

wow_ui_read_file ~112

Read a Lua or XML file from Blizzard's shipped interface source, by the path that wow_ui_grep or wow_ui_template_search reported. Use this to see a full implementation in context rather than a single matching line.

NameTypeReqDescription
endLineinteger
flavorstringGame client. Defaults to retail.
pathstringyesPath relative to the UI source root, e.g. Interface/AddOns/Blizzard_UIParent/UIParent.lua.
startLineinteger

No output schema declared.

No examples provided.

wow_ui_template_search ~136

Search the virtual XML templates that ship with the game — the frames an addon can inherit by name to get Blizzard's own look and behaviour (buttons, scroll lists, panels, tooltips). Shows the inheritance chain, attached mixins and where each is defined. Use this instead of writing frame art from scratch.

NameTypeReqDescription
flavorstringGame client. Defaults to retail.
limitinteger
querystringyesTemplate name or fragment, e.g. ScrollBox or UIPanelButton.
typestringRestrict to an element type, e.g. Button, Frame, CheckButton.

No output schema declared.

No examples provided.

wow_xml_validate ~102

Validate WoW interface XML against Blizzard's own UI.xsd: unknown or misspelled elements and attributes, invalid nesting, bad enum values, and structural mistakes like a virtual frame with no name. Run this on every XML file an addon loads — the client silently ignores what it does not understand, so these mistakes are otherwise invisible.

NameTypeReqDescription
pathstringPath to a .xml file to validate.
xmlstringXML source to validate.

No output schema declared.

No examples provided.

Common questions

What is the Hated WoW MCP server?

Hated WoW MCP is listed in the public MCP registry as io.github.RdyGaming/hated-wow-mcp. MCP server for WoW addons: Lua API, Blizzard UI source, CVars, art lookup, linting, scaffolding. This page covers its npm package (hated-wow-mcp).

Is the Hated WoW MCP server safe to use?

Hated WoW MCP scores 68 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Hated WoW MCP server expose?

Hated WoW MCP exposes 20 tools: wow_api_search, wow_api_event_search, wow_api_type_search, wow_api_diff, wow_api_stats, and 15 more. Their descriptions and schemas cost roughly 2,454 tokens of context every time the server is loaded.

Is the Hated WoW MCP server still maintained?

Hated WoW MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Hated WoW MCP server under?

Hated WoW MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.