Watchgoose

MCP Server

The Model Context Protocol (MCP) lets supported AI clients use Watchgoose tools through a project-scoped connection you approve.

Available in

Watchgoose is available in the Claude connector directory.

Watchgoose is listed in ChatGPT plugins for GPT and Codex.

Watchgoose is listed in the official MCP Registry.

The watchgoose-mcp package is available on npm.

The Watchgoose plugin with the hosted server and five agent skills is published at pixeware/watchgoose-plugin for Gemini CLI, Grok Build, and other agents.

Choose Your Client

Claude · Claude Code · ChatGPT and Codex · Cursor · VS Code · Cline · Gemini CLI · Grok Build · project API key · other remote clients

Connect Claude {: #connect-claude }

In Claude, open Settings > Connectors, add a custom connector, and enter:

https://mcp.watchgoose.com/mcp

Claude opens Watchgoose in your browser. Sign in, choose one project, review the requested access, and continue. Read-only access is selected by default.

Connect Claude Code {: #connect-claude-code }

Add the hosted Streamable HTTP server for your user:

claude mcp add --transport http --scope user watchgoose https://mcp.watchgoose.com/mcp

Start Claude Code and complete the browser authorization when prompted. Run claude mcp get watchgoose to inspect the saved connection.

Connect ChatGPT and Codex {: #connect-chatgpt-codex }

Open the Watchgoose plugin in ChatGPT plugins, linked above, and connect it. Codex uses the same plugin. Sign in to Watchgoose in the browser, choose one project, and approve access. The plugin also adds the five agent skills.

Connect Cursor {: #connect-cursor }

Add this entry to .cursor/mcp.json in your project, or to your user MCP configuration:

{
  "mcpServers": {
    "watchgoose": {
      "url": "https://mcp.watchgoose.com/mcp"
    }
  }
}

Cursor opens Watchgoose in your browser when it first connects. Sign in, choose one project, and approve access.

Connect VS Code {: #connect-vs-code }

Create .vscode/mcp.json in your workspace:

{
  "servers": {
    "watchgoose": {
      "type": "http",
      "url": "https://mcp.watchgoose.com/mcp"
    }
  }
}

Run MCP: List Servers, start watchgoose, and complete the browser authorization when VS Code asks.

Connect Cline {: #connect-cline }

Open MCP Servers > Configure MCP Servers and add this entry to cline_mcp_settings.json:

{
  "mcpServers": {
    "watchgoose": {
      "type": "streamableHttp",
      "url": "https://mcp.watchgoose.com/mcp"
    }
  }
}

Keep "type": "streamableHttp" exactly as written. Without it, Cline falls back to SSE and the connection fails. When Cline asks you to authenticate, sign in to Watchgoose in the browser and choose one project.

Connect Gemini CLI {: #connect-gemini-cli }

Install the Watchgoose extension, which adds the hosted server and the five agent skills:

gemini extensions install https://github.com/pixeware/watchgoose-plugin

Restart Gemini CLI and complete the browser authorization when prompted.

Connect Grok Build {: #connect-grok-build }

Install the Watchgoose plugin, which adds the hosted server and the five agent skills:

grok plugin install pixeware/watchgoose-plugin --trust

Connect the watchgoose server when Grok asks and approve access in the browser.

Use a Project API Key Instead {: #project-api-key }

Clients without remote OAuth support can run the watchgoose-mcp npm package locally with Node.js 20 or later and a project API key from Project settings > API Access. This entry uses the mcpServers format of Claude Desktop, Cursor, and Cline:

{
  "mcpServers": {
    "watchgoose": {
      "command": "npx",
      "args": ["-y", "watchgoose-mcp"],
      "env": {
        "WATCHGOOSE_API_KEY": "hcr_your_project_key"
      }
    }
  }
}

VS Code uses a different format in .vscode/mcp.json: put the entry under "servers" instead of "mcpServers" and add "type": "stdio".

An hcr_ key is read-only. An hcw_ key also allows pings, integrations, and check changes, but write tools stay disabled until you also set "WATCHGOOSE_ENABLE_WRITES": "true" in env. Put the key in the client's configuration file, never in a chat with the AI assistant.

Other Remote Clients {: #other-remote-clients }

Use https://mcp.watchgoose.com/mcp in clients that support remote Streamable HTTP MCP servers, OAuth 2.1, PKCE, and Dynamic Client Registration. The OAuth issuer is https://mcp.watchgoose.com. You do not paste a Watchgoose API key into a remote client.

Project Access

Each connection is limited to one project. The consent screen always starts with Read-only access. It offers Read and write only when the client requests the mcp:write scope and you have permission to modify the selected project.

Changing a read-only connection to read and write requires a new authorization. Revoke the existing connection under Account settings > MCP Connections, disconnect it in the client, and connect again. Review every requested write operation in the client before approving it.

Tools

Tool	What it does	Required OAuth scope
list_checks	Lists checks, with optional slug or tag filters.	mcp:read
get_check	Gets one check and its current state and schedule.	mcp:read
list_flips	Lists retained status changes. up: 1 means the check became up; up: 0 includes down, paused, and new after resume. A pause or resume that changes status records a flip.	mcp:read
list_pings	Lists recent signals without source or body data.	mcp:read + mcp:write
list_channels	Lists integration names and kinds for assignments.	mcp:read + mcp:write
create_check	Creates a simple, cron, or OnCalendar check.	mcp:read + mcp:write
update_check	Changes selected fields on a check.	mcp:read + mcp:write
pause_check	Pauses monitoring without deleting a check.	mcp:read + mcp:write
resume_check	Resumes a paused check.	mcp:read + mcp:write
delete_check	Permanently deletes a check and its retained history.	mcp:read + mcp:write

A connection stays signed in while the AI client uses it. Each time the client refreshes its access, the connection is extended to 30 days from that moment, up to one year after you approved it. After 30 days without use, or after one year, the client asks you to approve the connection again. Clients may request the offline_access scope, but it isn't required and doesn't expose additional tools.

Identifiers and Private Fields

AI clients address checks by their stable unique_key. The MCP server uses internal identifiers only when calling the Management API and removes them from tool results.

The connected AI client never receives check UUIDs or ping URLs, integration channel UUIDs, source IP addresses, user agents, run IDs, body URLs, or ping body contents. Ping results include only signal type, date, sequence number, scheme, method, and duration. The server does not request ping bodies.

Credentials, Storage, and Revocation

Watchgoose exchanges a single-use, five-minute handoff for a delegated project credential. The hosted MCP service processes that credential in memory for API requests and stores it only in encrypted OAuth state. It never returns the credential, OAuth tokens, or API keys to the AI client as tool output.

OAuth client, authorization, session, grant, and delegated credential state is stored in service-owned SQLite on the single production host in one region. The state and its identifiers are encrypted or keyed at rest and follow the normal production backup rotation. The MCP application adds no telemetry. The production proxy keeps normal security and operational access logs, including source address, user agent, full request URI including its query string, method, status, and timestamp. It removes authorization and cookie headers from those logs and skips the OAuth callback entirely. It also removes the credential-bearing X-Api-Key header used for project API requests. Access-log fields are never returned as tool output.

Watchgoose keeps connection metadata and records each MCP API operation, route, method, outcome, HTTP status, and timestamp. Audit events are retained for 90 days. Revoke a connection under Account settings > MCP Connections to block future project API access. The client must complete authorization again to reconnect.

Read the Privacy Policy for the complete processing and retention boundary.

{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://watchgoose.com/"},{"@type":"ListItem","position":2,"name":"Documentation","item":"https://watchgoose.com/docs/"},{"@type":"ListItem","position":3,"name":"MCP Server","item":"https://watchgoose.com/docs/mcp/"}]}