Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Hated WoW MCP

NPM · HATED-WOW-MCP

MCP server for WoW addons: Lua API, UI source, CVars, art, linting, plus model export to glTF/OBJ.

Available components

−1 this week 78 Trust /100

Last scanned (21 hours ago)

Scores higher than 58% of npm servers

Category Developer Tools

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 2 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3839 tokens (~142/item across 27 items; 27 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage93
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 80% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 27 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 0
    • Security disclosure: unverified → pass ▲ functional
  • 2 Nov 26 0
    • Security disclosure: pass → unverified ▼ functional
  • 1 Nov 26 +15
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Malware scan: unverified → pass ▲ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • First check of Schema quality: unverified functional
    • Package version: 0.7.0 → 0.8.0 functional
  • 31 Oct 26 −16
    • Malware scan: pass → unverified ▼ security
    • Schema quality: 2616 → 3785 ▼ functional
    • Security disclosure: pass → unverified ▼ functional
    • Package version: 0.6.1 → 0.7.0 functional
  • 26 Oct 26 0
    • Stability: 0.97 → pass security
  • 25 Oct 26 0
    • Stability: pass → 0.97 functional
  • 24 Oct 26 −2
    • CVE-2023-54404 affects this package: high ▼ security
  • 18 Oct 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/hated-wow-mcp@0.8.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-gh4j-gqv2-49f6 CVE-2026-41650 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 95 packages
Packages resolved 95
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 27 exposed · ~3,677 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
wow_addon_scaffold ~283

Generate a complete, working addon skeleton: .toc manifests for the chosen clients, an event-dispatch Core.lua with SavedVariables handling and a slash command, and optionally an XML frame template with its Lua mixin and a Settings-API options panel. Use this to start a new addon rather than writing boilerplate by hand. By default it only returns the files. With `write` it saves them into the addon folder, and it refuses if any of the files already exist unless `overwrite` is also set.

NameTypeReqDescription
authorstring––
flavorsarray–Clients to support. Defaults to retail only.
namestringyesAddon name; also the folder name.
notesstring–One-line description for the .toc and README.
overwriteboolean–With `write`, replace files that already exist. Off by default: scaffolding a name that matches an installed addon would otherwise silently replace its real files.
savedVariablesarray––
slashCommandstring–Slash command without the leading slash.
versionstring––
withFrameboolean–Include an XML template and frame mixin.
withOptionsboolean–Include a Settings API options panel.
writeboolean–Write the files into the configured addon folder instead of just returning them.

No output schema declared.

No examples provided.

wow_api_diff ~89

Check whether a function, event or type exists in each game client (retail, Classic progression, Classic Era, WoW Forever). Use this before writing code that has to run on more than one flavor, or to explain why something works on Classic but not retail.

NameTypeReqDescription
namestringyesFunction, event or type name, e.g. GetSpellInfo or C_Item.GetItemInfo.

No output schema declared.

No examples provided.

wow_api_event_search ~101

Search the events an addon can register with frame:RegisterEvent, and show each event's payload arguments in order. Use this whenever writing an OnEvent handler, so the argument list matches what the client sends.

NameTypeReqDescription
flavorstring–Game client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
limitinteger––
querystringyesEvent name or fragment, e.g. COMBAT_LOG or BAG_UPDATE.

No output schema declared.

No examples provided.

wow_api_search ~159

Search World of Warcraft's in-game Lua API — the functions an addon can call from inside the client. Covers namespaced functions (C_Item.GetItemInfo), legacy globals (UnitHealth), and widget methods (Frame:SetPoint). Results include full argument and return signatures. Use this before writing any addon code that calls the game.

NameTypeReqDescription
flavorstring–Game client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
limitinteger––
namespacestring–Restrict to one namespace, e.g. C_Spell.
querystringyesFunction name or fragment. Matches exact names, prefixes, substrings and camel-hump abbreviations (GIIBID finds GetItemInfoByID).

No output schema declared.

No examples provided.

wow_api_stats ~51

Report which API index, UI source and game data sets this server has, when each was synced, and how large it is. Use this to confirm the data is present and current before relying on other tools.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wow_api_type_search ~113

Search the Enum.*, Constants.* and structure tables the in-game API uses — for example Enum.ItemQuality or the AuraData structure returned by C_UnitAuras. Searching for a member name finds the table that contains it.

NameTypeReqDescription
flavorstring–Game client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
kindstring–Restrict to one kind of table.
limitinteger––
querystringyesType, enum, constant or member name.

No output schema declared.

No examples provided.

wow_atlas_search ~131

Search the named texture atlas elements the UI uses with SetAtlas, the modern way to reference Blizzard art, since an atlas name carries its own size and coordinates. Returns dimensions, the sheet FileDataID and the exact SetAtlas call. Prefer atlases over raw texture paths for UI art. Atlases differ between clients, so name the flavor you are writing for: an atlas that exists on retail may not exist on WoW Forever or Classic.

NameTypeReqDescription
flavorstring–Game client. Defaults to retail.
limitinteger––
querystringyesAtlas element name or fragment.

No output schema declared.

No examples provided.

wow_creature_export ~247

Export a creature or NPC as glTF with animations and its skin textures, headless. Beasts and monsters get their display skin and geosets. Humanoid NPCs (built from a player race model) get the right race and sex model, the NPC's hair, beard and similar geosets, the baked NPC skin and their worn armor (boots, robes, tabards and so on). Helms, shoulders and the NPC's weapons are written as separate models beside it, with the bone and position each one attaches to. Written to <outputDir>/creatures/.

NameTypeReqDescription
animationsboolean–Include animations. Default true.
creatureIdinteger–Creature id from wow_creature_search.
displayIdinteger–Display id, when there is no creature id.
equipmentboolean–Apply worn armor and write helm, shoulder and weapon models. Default true.
flavorstring–Which installed client to read: mainline (retail), forever, classic or vanilla. Defaults to the first install found.
formatstring––
outputDirstringyesFolder to write into (created if missing).

No output schema declared.

No examples provided.

wow_creature_search ~117

Find creatures and NPCs by name (or creature id, or display id) in the local game files, with the model each one uses. Opens the game storage, so the first call takes about 40 seconds. Use the id with wow_creature_export.

NameTypeReqDescription
flavorstring–Which installed client to read: mainline (retail), forever, classic or vanilla. Defaults to the first install found.
limitinteger––
querystringyesCreature name fragment, creature id or display id.

No output schema declared.

No examples provided.

wow_cvar_search ~146

Find the game's console variables — the settings behind SetCVar/GetCVar. Covers every CVar the client registers, and for the ones Blizzard's own UI touches, shows how it reads them, where, and what the options screen calls them. Use this before writing SetCVar, or to discover which CVar controls a piece of game behaviour.

NameTypeReqDescription
flavorstring–Game client. Defaults to retail.
limitinteger––
querystringyesCVar name or fragment, e.g. nameplate, cameraDistance.
usedOnlyboolean–Only CVars Blizzard's own UI reads or writes — the documented-by-example ones.

No output schema declared.

No examples provided.

wow_data_status ~55

Report which game data sets are synced — the file/FileDataID index and the texture atlas index — with counts and sync dates, and what to run for any that are missing. Use this when a game data lookup returns nothing.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wow_file_search ~176

Find game art and asset files by name, and get the FileDataID and texture path an addon needs to reference them. Covers every interface texture and icon (and models and maps when the full index is synced). A numeric query is treated as a FileDataID and resolved back to its path. Use this whenever writing SetTexture, SetNormalTexture or SetModel.

NameTypeReqDescription
extstring–Restrict by extension, e.g. blp or m2.
includeNonInterfaceboolean–Search beyond interface/** — models, maps, sounds. Requires the full index.
limitinteger––
querystringyesFile name fragment, or a numeric FileDataID to resolve.
understring–Restrict to a path prefix, e.g. interface/icons/ or interface/buttons/.

No output schema declared.

No examples provided.

wow_icon_search ~104

Search the game's icon textures by name and return the path and FileDataID for each. Icons follow a naming convention (spell_fire_*, inv_sword_*, ability_warrior_*), so searching by theme works well. Use this to pick an icon for a button, an addon compartment entry, or a .toc IconTexture.

NameTypeReqDescription
limitinteger––
querystringyesIcon name fragment, e.g. fireball, sword, warrior.

No output schema declared.

No examples provided.

wow_install_info ~51

Report the World of Warcraft installations found on this machine — their paths, flavors, build numbers, and the addons currently installed. Use this to confirm which client tools will target and to discover addon folders to lint.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wow_lua_lint ~159

Analyse addon Lua for problems specific to World of Warcraft: APIs that were removed or moved into a namespace in the target client, unknown events, taint (calling protected functions, overwriting Blizzard globals, touching secure frames in combat), and performance traps. Run this on any addon Lua before shipping it, and whenever porting between clients.

NameTypeReqDescription
codestring–Lua source to analyse.
disablearray–Rule ids to suppress.
flavorstring–Target client. Defaults to retail.
knownGlobalsarray–Globals defined elsewhere (embedded libraries, other files) — suppresses unknown-API warnings for them.
pathstring–Path to a .lua file to analyse instead of inline code.

No output schema declared.

No examples provided.

wow_map_export ~251

Export terrain tiles of a map as OBJ with a texture, headless. Give a map id from wow_map_search plus tiles, or a world position. Texture modes: 'tex0' blends the tile's layers into one PNG (default), 'alpha' writes the layer textures and blend masks, 'none' is geometry only. Optionally places the tile's buildings and props. Written to <outputDir>/maps/<directory>/. Baked high-resolution textures are not supported (they need a GPU).

NameTypeReqDescription
flavorstring–Which installed client to read: mainline (retail), forever, classic or vanilla. Defaults to the first install found.
mapIdintegeryesMap id from wow_map_search.
objectsboolean–Also export the tile's WMO and M2 placements. Slow.
outputDirstringyesFolder to write into (created if missing).
texturestring––
tilesarray–Tile pairs [a, b] from the file name map_a_b.adt.
xnumber–World x (north); with y, picks the tile.
ynumber–World y (west).

No output schema declared.

No examples provided.

wow_map_search ~150

Find maps (continents, instances, battlegrounds) by name, directory or id in the local game files. Also converts a world position to the terrain tile that holds it. Opens the game storage, so the first call takes about 40 seconds.

NameTypeReqDescription
flavorstring–Which installed client to read: mainline (retail), forever, classic or vanilla. Defaults to the first install found.
querystringyesMap name fragment, directory (e.g. 'Kalimdor') or map id.
xnumber–World x (north) to find the tile for.
ynumber–World y (west) to find the tile for.

No output schema declared.

No examples provided.

wow_model_export ~218

Export a model from the local WoW install's game files into a folder, headless. M2 models become glTF with animations (or GLB/OBJ); WMO models become OBJ+MTL (or glTF). Textures are decoded to PNG beside the model in the game's folder layout, so relative texture paths resolve in Blender. The first call opens the game storage and takes about 30 seconds. Needs the game-data and model-data syncs.

NameTypeReqDescription
animationsboolean–Include animations for M2 glTF. Default true.
flavorstring–Which installed client to read: mainline (retail), forever, classic or vanilla. Defaults to the first install found.
formatstring–Default: gltf for M2, obj for WMO.
modelstring|numberyesFileDataID or listfile path.
outputDirstringyesFolder to write into (created if missing).
splitGroupsboolean–WMO OBJ: one object per group.

No output schema declared.

No examples provided.

wow_model_search ~129

Find M2 (creature, doodad, prop) and WMO (building, dungeon) models in the game's listfile by path fragment, or resolve a numeric FileDataID. Returns the FileDataID and path to pass to wow_model_export. Needs the game-data sync.

NameTypeReqDescription
kindstring–Restrict to creatures/props (m2) or buildings (wmo).
limitinteger––
querystringyesWords that appear in the path, e.g. 'thunder bluff' or 'cairne', or a FileDataID.

No output schema declared.

No examples provided.

wow_texture_export ~111

Decode a BLP texture from the local WoW install to PNG, keeping the game's folder layout under outputDir. Accepts a FileDataID or listfile path.

NameTypeReqDescription
flavorstring–Which installed client to read: mainline (retail), forever, classic or vanilla. Defaults to the first install found.
outputDirstringyesFolder to write into (created if missing).
texturestring|numberyesFileDataID or listfile path of a .blp.

No output schema declared.

No examples provided.

wow_toc_validate ~124

Validate a .toc manifest: interface version against the target client, flavor suffix consistency, unrecognised directives the client silently drops, SavedVariables names, and files listed but missing (or present but unlisted). Run this whenever an addon fails to load or shows as out of date.

NameTypeReqDescription
fileNamestring–Filename to assume when validating inline contents, e.g. MyAddon_Vanilla.toc.
pathstring–Path to a .toc file, or to an addon folder.
tocstring–.toc contents to validate.

No output schema declared.

No examples provided.

wow_ui_grep ~177

Regex-search the full Lua and XML source of the 348 Blizzard addons that ship with the client. This is the ground truth for how the game itself does something — event handling, secure frames, data providers, layout. Use it when the API reference tells you what a function is but not how it is meant to be used.

NameTypeReqDescription
contextinteger–Lines of surrounding context per hit.
extstring–Restrict by file type.
flavorstring–Game client. Defaults to retail.
ignoreCaseboolean––
limitinteger––
pathContainsstring–Restrict to paths containing this.
patternstringyesJavaScript regular expression to search for.
pkgstring–Restrict to one Blizzard package, e.g. Blizzard_ActionBar.

No output schema declared.

No examples provided.

wow_ui_list_packages ~79

List the Blizzard_* addon packages that ship with the client, optionally filtered. Use this to find which package owns a piece of the UI before grepping it, e.g. Blizzard_ActionBar for action buttons.

NameTypeReqDescription
filterstring–Substring filter on the package name.
flavorstring–Game client. Defaults to retail.

No output schema declared.

No examples provided.

wow_ui_mixin_search ~106

Search the mixin tables Blizzard's UI uses — reusable method sets attached to frames via the XML mixin attribute or CreateFromMixins. Searching a method name finds the mixin that defines it. Use this to reuse Blizzard's behaviour or to understand what a template's methods do.

NameTypeReqDescription
flavorstring–Game client. Defaults to retail.
limitinteger––
querystringyesMixin name, fragment, or an exact method name.

No output schema declared.

No examples provided.

wow_ui_read_file ~112

Read a Lua or XML file from Blizzard's shipped interface source, by the path that wow_ui_grep or wow_ui_template_search reported. Use this to see a full implementation in context rather than a single matching line.

NameTypeReqDescription
endLineinteger––
flavorstring–Game client. Defaults to retail.
pathstringyesPath relative to the UI source root, e.g. Interface/AddOns/Blizzard_UIParent/UIParent.lua.
startLineinteger––

No output schema declared.

No examples provided.

wow_ui_template_search ~136

Search the virtual XML templates that ship with the game — the frames an addon can inherit by name to get Blizzard's own look and behaviour (buttons, scroll lists, panels, tooltips). Shows the inheritance chain, attached mixins and where each is defined. Use this instead of writing frame art from scratch.

NameTypeReqDescription
flavorstring–Game client. Defaults to retail.
limitinteger––
querystringyesTemplate name or fragment, e.g. ScrollBox or UIPanelButton.
typestring–Restrict to an element type, e.g. Button, Frame, CheckButton.

No output schema declared.

No examples provided.

wow_xml_validate ~102

Validate WoW interface XML against Blizzard's own UI.xsd: unknown or misspelled elements and attributes, invalid nesting, bad enum values, and structural mistakes like a virtual frame with no name. Run this on every XML file an addon loads — the client silently ignores what it does not understand, so these mistakes are otherwise invisible.

NameTypeReqDescription
pathstring–Path to a .xml file to validate.
xmlstring–XML source to validate.

No output schema declared.

No examples provided.

Install

How do I install the Hated WoW MCP server?

Hated WoW MCP runs locally as an npm package, launched with npx -y hated-wow-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · hated-wow-mcp

# add to Claude Code
claude mcp add rdygaming-hated-wow-mcp -- npx -y hated-wow-mcp
Common questions

What is the Hated WoW MCP server?

Hated WoW MCP is listed in the public MCP registry as io.github.RdyGaming/hated-wow-mcp. MCP server for WoW addons: Lua API, UI source, CVars, art, linting, plus model export to glTF/OBJ. This page covers its npm package (hated-wow-mcp).

Is the Hated WoW MCP server safe to use?

Hated WoW MCP scores 78 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Hated WoW MCP server expose?

Hated WoW MCP exposes 27 tools: wow_api_search, wow_api_event_search, wow_api_type_search, wow_api_diff, wow_api_stats, and 22 more. Their descriptions and schemas cost roughly 3,677 tokens of context every time the server is loaded.

Is the Hated WoW MCP server still maintained?

Hated WoW MCP is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Hated WoW MCP server under?

Hated WoW MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.