Activitywatch MCP Server

Findings (17)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@0.7.0: 2 known vulnerabilities

  GHSA-6prh-2h8m-c8cw, GHSA-w48q-cv73-mx4w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.7.9: 33 known vulnerabilities

  GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3 +28 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.11: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@2.0.1: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  browserslist@4.24.4: 2 known vulnerabilities

  GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@3.14.1: 5 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@3.1.2: 3 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@5.1.6: 3 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@2.3.1: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.24.2: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @babel/core@7.26.9: 1 known vulnerability

  GHSA-4x5r-pxfx-6jf8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @babel/helpers@7.26.9: 1 known vulnerability

  GHSA-968p-4wvh-cqc8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  deepmerge@4.3.1: 1 known vulnerability

  GHSA-gcqx-w48m-w2h4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  follow-redirects@1.15.9: 1 known vulnerability

  GHSA-r4q5-vmmm-2653

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  npm run build

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (10)

• activitywatch_list_buckets

  List all ActivityWatch buckets with optional type filtering

• activitywatch_query_examples

  Get examples of properly formatted queries for the ActivityWatch MCP server

• activitywatch_run_query

  Run a query in ActivityWatch's query language

• activitywatch_get_events

  Get raw events from an ActivityWatch bucket

• activitywatch_get_settings

  Get ActivityWatch settings. Can retrieve all settings or a specific key if provided.

• activitywatch_get_categories

  Get all ActivityWatch categories (classification rules). Returns the list of categories with their regex rules used to classify window events.

• activitywatch_get_uncategorized_events

  Fetch window events that have NOT been matched by any category rule, grouped and sorted by total duration. Use this to discover what activities need new category rules. Returns the top N app+title combinations by time spent.

• activitywatch_add_category

  Add a new category to ActivityWatch. The category will be appended to the existing list.

• activitywatch_update_category

  Update an existing ActivityWatch category by its name path. Replaces the matching category with new values.

• activitywatch_delete_category

  Delete an ActivityWatch category by its name path.