# Hated WoW MCP (npm · hated-wow-mcp)

MCP server for WoW addons: Lua API, Blizzard UI source, CVars, art lookup, linting, scaffolding.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `hated-wow-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/rdygaming-hated-wow-mcp/hated-wow-mcp.md), [page](https://verifymcp.io/servers/rdygaming-hated-wow-mcp/hated-wow-mcp)

## Channel facts

- Registry: `npm`
- Package: `hated-wow-mcp`
- Version: `0.6.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects fast-xml-parser 4.5.7, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 31 of 98 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 76/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2616 tokens (~130/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 92/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 76% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Hated WoW MCP server?

Hated WoW MCP runs locally as an npm package, launched with npx -y hated-wow-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add rdygaming-hated-wow-mcp -- npx -y hated-wow-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "rdygaming-hated-wow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "rdygaming-hated-wow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add rdygaming-hated-wow-mcp -- npx -y hated-wow-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rdygaming-hated-wow-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "hated-wow-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add rdygaming-hated-wow-mcp --command npx --arg -y --arg hated-wow-mcp
```

### Hermes

```yaml
mcp_servers:
  rdygaming-hated-wow-mcp:
    command: "npx"
    args: ["-y", "hated-wow-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "rdygaming-hated-wow-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add rdygaming-hated-wow-mcp -t stdio -c npx -a -y hated-wow-mcp
```

### Other

```json
{
  "mcpServers": {
    "rdygaming-hated-wow-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hated-wow-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 68, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-09-19 (score 52, 0)

- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.6.0 → 0.6.1

### 2026-09-18 (score 52)

First indexed and scored.

## MCP tools (20)

### `wow_api_search` (~159 tokens)

Search the in-game Lua API

Search World of Warcraft's in-game Lua API — the functions an addon can call from inside the client. Covers namespaced functions (C_Item.GetItemInfo), legacy globals (UnitHealth), and widget methods (Frame:SetPoint). Results include full argument and return signatures. Use this before writing any addon code that calls the game.

Input parameters:

- `flavor` (string): Game client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
- `limit` (integer)
- `namespace` (string): Restrict to one namespace, e.g. C_Spell.
- `query` (string, required): Function name or fragment. Matches exact names, prefixes, substrings and camel-hump abbreviations (GIIBID finds GetItemInfoByID).

### `wow_api_event_search` (~101 tokens)

Search in-game events

Search the events an addon can register with frame:RegisterEvent, and show each event's payload arguments in order. Use this whenever writing an OnEvent handler, so the argument list matches what the client sends.

Input parameters:

- `flavor` (string): Game client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
- `limit` (integer)
- `query` (string, required): Event name or fragment, e.g. COMBAT_LOG or BAG_UPDATE.

### `wow_api_type_search` (~113 tokens)

Search API enums, structures and constants

Search the Enum.*, Constants.* and structure tables the in-game API uses — for example Enum.ItemQuality or the AuraData structure returned by C_UnitAuras. Searching for a member name finds the table that contains it.

Input parameters:

- `flavor` (string): Game client to answer for. Defaults to WOW_DEFAULT_FLAVOR, or retail.
- `kind` (string): Restrict to one kind of table.
- `limit` (integer)
- `query` (string, required): Type, enum, constant or member name.

### `wow_api_diff` (~89 tokens)

Compare API availability across clients

Check whether a function, event or type exists in each game client (retail, Classic progression, Classic Era, WoW Forever). Use this before writing code that has to run on more than one flavor, or to explain why something works on Classic but not retail.

Input parameters:

- `name` (string, required): Function, event or type name, e.g. GetSpellInfo or C_Item.GetItemInfo.

### `wow_api_stats` (~51 tokens)

Show what API data is loaded

Report which API index, UI source and game data sets this server has, when each was synced, and how large it is. Use this to confirm the data is present and current before relying on other tools.

### `wow_ui_template_search` (~136 tokens)

Search Blizzard's XML frame templates

Search the virtual XML templates that ship with the game — the frames an addon can inherit by name to get Blizzard's own look and behaviour (buttons, scroll lists, panels, tooltips). Shows the inheritance chain, attached mixins and where each is defined. Use this instead of writing frame art from scratch.

Input parameters:

- `flavor` (string): Game client. Defaults to retail.
- `limit` (integer)
- `query` (string, required): Template name or fragment, e.g. ScrollBox or UIPanelButton.
- `type` (string): Restrict to an element type, e.g. Button, Frame, CheckButton.

### `wow_ui_mixin_search` (~106 tokens)

Search Blizzard's Lua mixins

Search the mixin tables Blizzard's UI uses — reusable method sets attached to frames via the XML mixin attribute or CreateFromMixins. Searching a method name finds the mixin that defines it. Use this to reuse Blizzard's behaviour or to understand what a template's methods do.

Input parameters:

- `flavor` (string): Game client. Defaults to retail.
- `limit` (integer)
- `query` (string, required): Mixin name, fragment, or an exact method name.

### `wow_cvar_search` (~146 tokens)

Look up console variables (CVars)

Find the game's console variables — the settings behind SetCVar/GetCVar. Covers every CVar the client registers, and for the ones Blizzard's own UI touches, shows how it reads them, where, and what the options screen calls them. Use this before writing SetCVar, or to discover which CVar controls a piece of game behaviour.

Input parameters:

- `flavor` (string): Game client. Defaults to retail.
- `limit` (integer)
- `query` (string, required): CVar name or fragment, e.g. nameplate, cameraDistance.
- `usedOnly` (boolean): Only CVars Blizzard's own UI reads or writes — the documented-by-example ones.

### `wow_ui_grep` (~177 tokens)

Search Blizzard's UI source code

Regex-search the full Lua and XML source of the 348 Blizzard addons that ship with the client. This is the ground truth for how the game itself does something — event handling, secure frames, data providers, layout. Use it when the API reference tells you what a function is but not how it is meant to be used.

Input parameters:

- `context` (integer): Lines of surrounding context per hit.
- `ext` (string): Restrict by file type.
- `flavor` (string): Game client. Defaults to retail.
- `ignoreCase` (boolean)
- `limit` (integer)
- `pathContains` (string): Restrict to paths containing this.
- `pattern` (string, required): JavaScript regular expression to search for.
- `pkg` (string): Restrict to one Blizzard package, e.g. Blizzard_ActionBar.

### `wow_ui_read_file` (~112 tokens)

Read a file from Blizzard's UI source

Read a Lua or XML file from Blizzard's shipped interface source, by the path that wow_ui_grep or wow_ui_template_search reported. Use this to see a full implementation in context rather than a single matching line.

Input parameters:

- `endLine` (integer)
- `flavor` (string): Game client. Defaults to retail.
- `path` (string, required): Path relative to the UI source root, e.g. Interface/AddOns/Blizzard_UIParent/UIParent.lua.
- `startLine` (integer)

### `wow_ui_list_packages` (~79 tokens)

List Blizzard's shipped UI packages

List the Blizzard_* addon packages that ship with the client, optionally filtered. Use this to find which package owns a piece of the UI before grepping it, e.g. Blizzard_ActionBar for action buttons.

Input parameters:

- `filter` (string): Substring filter on the package name.
- `flavor` (string): Game client. Defaults to retail.

### `wow_lua_lint` (~159 tokens)

Lint addon Lua against a game client

Analyse addon Lua for problems specific to World of Warcraft: APIs that were removed or moved into a namespace in the target client, unknown events, taint (calling protected functions, overwriting Blizzard globals, touching secure frames in combat), and performance traps. Run this on any addon Lua before shipping it, and whenever porting between clients.

Input parameters:

- `code` (string): Lua source to analyse.
- `disable` (array): Rule ids to suppress.
- `flavor` (string): Target client. Defaults to retail.
- `knownGlobals` (array): Globals defined elsewhere (embedded libraries, other files) — suppresses unknown-API warnings for them.
- `path` (string): Path to a .lua file to analyse instead of inline code.

### `wow_xml_validate` (~102 tokens)

Validate interface XML

Validate WoW interface XML against Blizzard's own UI.xsd: unknown or misspelled elements and attributes, invalid nesting, bad enum values, and structural mistakes like a virtual frame with no name. Run this on every XML file an addon loads — the client silently ignores what it does not understand, so these mistakes are otherwise invisible.

Input parameters:

- `path` (string): Path to a .xml file to validate.
- `xml` (string): XML source to validate.

### `wow_toc_validate` (~124 tokens)

Validate an addon .toc manifest

Validate a .toc manifest: interface version against the target client, flavor suffix consistency, unrecognised directives the client silently drops, SavedVariables names, and files listed but missing (or present but unlisted). Run this whenever an addon fails to load or shows as out of date.

Input parameters:

- `fileName` (string): Filename to assume when validating inline contents, e.g. MyAddon_Vanilla.toc.
- `path` (string): Path to a .toc file, or to an addon folder.
- `toc` (string): .toc contents to validate.

### `wow_addon_scaffold` (~283 tokens)

Generate an addon skeleton

Generate a complete, working addon skeleton: .toc manifests for the chosen clients, an event-dispatch Core.lua with SavedVariables handling and a slash command, and optionally an XML frame template with its Lua mixin and a Settings-API options panel. Use this to start a new addon rather than writing boilerplate by hand. By default it only returns the files. With `write` it saves them into the addon folder, and it refuses if any of the files already exist unless `overwrite` is also set.

Input parameters:

- `author` (string)
- `flavors` (array): Clients to support. Defaults to retail only.
- `name` (string, required): Addon name; also the folder name.
- `notes` (string): One-line description for the .toc and README.
- `overwrite` (boolean): With `write`, replace files that already exist. Off by default: scaffolding a name that matches an installed addon would otherwise silently replace its real files.
- `savedVariables` (array)
- `slashCommand` (string): Slash command without the leading slash.
- `version` (string)
- `withFrame` (boolean): Include an XML template and frame mixin.
- `withOptions` (boolean): Include a Settings API options panel.
- `write` (boolean): Write the files into the configured addon folder instead of just returning them.

### `wow_install_info` (~51 tokens)

Show the local WoW installation

Report the World of Warcraft installations found on this machine — their paths, flavors, build numbers, and the addons currently installed. Use this to confirm which client tools will target and to discover addon folders to lint.

### `wow_file_search` (~176 tokens)

Look up game files and FileDataIDs

Find game art and asset files by name, and get the FileDataID and texture path an addon needs to reference them. Covers every interface texture and icon (and models and maps when the full index is synced). A numeric query is treated as a FileDataID and resolved back to its path. Use this whenever writing SetTexture, SetNormalTexture or SetModel.

Input parameters:

- `ext` (string): Restrict by extension, e.g. blp or m2.
- `includeNonInterface` (boolean): Search beyond interface/** — models, maps, sounds. Requires the full index.
- `limit` (integer)
- `query` (string, required): File name fragment, or a numeric FileDataID to resolve.
- `under` (string): Restrict to a path prefix, e.g. interface/icons/ or interface/buttons/.

### `wow_icon_search` (~104 tokens)

Find an icon texture

Search the game's icon textures by name and return the path and FileDataID for each. Icons follow a naming convention (spell_fire_*, inv_sword_*, ability_warrior_*), so searching by theme works well. Use this to pick an icon for a button, an addon compartment entry, or a .toc IconTexture.

Input parameters:

- `limit` (integer)
- `query` (string, required): Icon name fragment, e.g. fireball, sword, warrior.

### `wow_atlas_search` (~131 tokens)

Find a texture atlas element

Search the named texture atlas elements the UI uses with SetAtlas, the modern way to reference Blizzard art, since an atlas name carries its own size and coordinates. Returns dimensions, the sheet FileDataID and the exact SetAtlas call. Prefer atlases over raw texture paths for UI art. Atlases differ between clients, so name the flavor you are writing for: an atlas that exists on retail may not exist on WoW Forever or Classic.

Input parameters:

- `flavor` (string): Game client. Defaults to retail.
- `limit` (integer)
- `query` (string, required): Atlas element name or fragment.

### `wow_data_status` (~55 tokens)

Show game data availability

Report which game data sets are synced — the file/FileDataID index and the texture atlas index — with counts and sync dates, and what to run for any that are missing. Use this when a game data lookup returns nothing.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/rdygaming-hated-wow-mcp/hated-wow-mcp#diagnostics

## Score history

- 2026-09-20: 68
- 2026-09-19: 52
- 2026-09-18: 52

## Common questions

### What is the Hated WoW MCP server?

Hated WoW MCP is listed in the public MCP registry as io.github.RdyGaming/hated-wow-mcp. MCP server for WoW addons: Lua API, Blizzard UI source, CVars, art lookup, linting, scaffolding. This page covers its npm package (hated-wow-mcp).

### Is the Hated WoW MCP server safe to use?

Hated WoW MCP scores 68 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Hated WoW MCP server expose?

Hated WoW MCP exposes 20 tools: wow_api_search, wow_api_event_search, wow_api_type_search, wow_api_diff, wow_api_stats, and 15 more. Their descriptions and schemas cost roughly 2,454 tokens of context every time the server is loaded.

### Is the Hated WoW MCP server still maintained?

Hated WoW MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Hated WoW MCP server under?

Hated WoW MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/hated-wow-mcp
- Socket report: https://socket.dev/npm/package/hated-wow-mcp
- Repository: https://github.com/RdyGaming/hated-wow-mcp
- Changelog RSS feed: https://verifymcp.io/servers/rdygaming-hated-wow-mcp/hated-wow-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/rdygaming-hated-wow-mcp/hated-wow-mcp.json
- HTML version of this page: https://verifymcp.io/servers/rdygaming-hated-wow-mcp/hated-wow-mcp