MCP.Market

Securityscorecard MCP server

by CallMarcus·io.github.CallMarcus/securityscorecard-mcp·v2.0.0
No reviews yet

Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

0 stars86 downloads/wk

Reviews

Write one

Nobody has reviewed Securityscorecard yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Securityscorecard tools (9, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_email_securitywrite action

    \u{1F4E7} EMAIL SECURITY: Analyze SPF, DMARC, DKIM issues with domain-by-domain breakdown and cross-validation. INTELLIGENT RESPONSES: Use 'minimal' for simple counts like 'how many SPF missing?' (10-30 tokens). Use 'standard' for email security overview (200-400 tokens). Use 'detailed' for comprehensive email analysis.

  • analyze_issue_types

    \u{1F50D} ISSUE BREAKDOWN: Get detailed breakdown of security issues by specific types (SPF, DMARC, patching, etc.). INTELLIGENT RESPONSES: Use 'minimal' for specific counts (20-50 tokens). Use 'standard' for issue type summary (200-300 tokens). Use 'detailed' for comprehensive breakdown.

  • analyze_security_risks

    \u{1F6A8} SECURITY RISKS: Comprehensive security risk analysis with intelligent prioritization. Analyzes critical vulnerabilities, risk patterns, and provides actionable remediation guidance with flexible response modes.

  • api_discovery

    Search and discover SecurityScorecard API endpoints. Returns both human-readable summary and structured JSON for programmatic use.

  • create_improvement_planwrite action

    \u{1F3AF} IMPROVEMENT PLAN: Generate security improvement recommendations. INTELLIGENT RESPONSES: Use 'minimal' for simple questions like 'what should I fix first?' (50-100 tokens). Use 'standard' for improvement summary (300-500 tokens). Use 'detailed' for full roadmap.

  • discover_assets

    \u{1F50D} ASSET INVENTORY: Discover domains and IPs with security context and data completeness validation. INTELLIGENT RESPONSES: Use 'minimal' for simple questions like 'how many assets?' (20-50 tokens). Use 'standard' for asset overview (200-400 tokens). Use 'detailed' for comprehensive inventory.

  • query_security_data

    Direct API access with smart endpoint validation. Uses API discovery to validate endpoints, suggest alternatives, and provide parameter hints.

  • security_dashboard

    \u{1F4CA} SECURITY STATUS: Get comprehensive security score, grade, and key metrics with intelligent response modes. Supports minimal responses for quick queries and detailed analysis for comprehensive security overviews.

  • validate_data_completeness

    \u2705 DATA VALIDATION: Cross-validate tool results for accuracy and completeness. INTELLIGENT RESPONSES: Use 'minimal' for validation status (25 tokens). Use 'standard' for validation summary (200-400 tokens). Use 'detailed' for full data audit.

Public scan report

scanner v0.1.10 · 2026-11-04 · same rubric, same numbers if you re-run it

no findings
  • Code scan12 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Securityscorecard compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,255 servers
Tools
9
the typical server has 7
Tools that change things
22%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
86
more than 59% of 12,191 servers with a package

What its tools let an agent do: 7 read · 1 create · 1 change

Release history: 2 versions in the registry since 2026-08-12, latest 2026-10-04, typically one every 53 days.

Install Securityscorecard in Claude Code, Cursor or VS Code

Runs npx -y @callmarcus/securityscorecard-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add securityscorecard-mcp -- npx -y @callmarcus/securityscorecard-mcp
Add to Cursor

What the publisher says

From the Securityscorecard repository's README, as published. We do not edit it. Read it on GitHub

SSC MCP Server

A community-built, comprehensive Model Context Protocol (MCP) server that integrates with the SecurityScorecard API. It runs over stdio, so it works with any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and others.

Published on npm as @callmarcus/securityscorecard-mcp and listed in the MCP Registry as io.github.CallMarcus/securityscorecard-mcp.

Disclaimer: This is an independent, community-built open-source project. It is not affiliated with, endorsed by, sponsored by, or associated with SecurityScorecard, Inc. in any way. It is built solely against SecurityScorecard's publicly available API documentation. "SecurityScorecard" and all related names, marks, and logos are trademarks of SecurityScorecard, Inc. and are used here for identification purposes only. You must supply your own API credentials and comply with SecurityScorecard's terms of service.

Quick Start

Prerequisites

  1. Node.js 20+ - Download
  2. SecurityScorecard API Token - Get from your SecurityScorecard dashboard

Option A — Install from npm (recommended)

No clone or build required. The server runs over stdio via npx, so any MCP-compatible client can launch it. npx -y always fetches the latest published version.

Most clients — Claude Desktop, Cursor, Cline, Windsurf, and others — share the same mcpServers JSON. Add this block to the client's MCP config:

{
  "mcpServers": {
    "security-scorecard": {
      "command": "npx",
      "args": ["-y", "@callmarcus/securityscorecard-mcp"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
        "COMPANY_DOMAIN": "example.com"
      }
    }
  }
}

Where that config file lives:

Replace the credentials with your own, then restart the client.

Claude Code — add it from the CLI instead:

claude mcp add security-scorecard \
  --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here \
  --env COMPANY_DOMAIN=example.com \
  -- npx -y @callmarcus/securityscorecard-mcp

On Windows, wrap the launcher in cmd /c: ... -- cmd /c npx -y @callmarcus/securityscorecard-mcp.

VS Code (Copilot) — uses a servers key with an explicit type, in .vscode/mcp.json:

{
  "servers": {
    "security-scorecard": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@callmarcus/securityscorecard-mcp"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
        "COMPANY_DOMAIN": "example.com"
      }
    }
  }
}

Option B — Run from source (for development)

# Clone the repository
git clone https://github.com/CallMarcus/security-scorecard-mcp.git
cd security-scorecard-mcp

# Install dependencies
npm install

# Build (use build:fast to avoid memory issues)
npm run build:fast

Then point your MCP client at the local build. For clients that use the mcpServers format (Claude Desktop, Cursor, …):

{
  "mcpServers": {
    "security-scorecard": {
      "command": "node",
      "args": ["/path/to/security-scorecard-mcp/build/index.js"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
        "COMPANY_DOMAIN": "example.com"
      }
    }
  }
}

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Securityscorecard: common questions

Is Securityscorecard MCP server safe?
Mostly: it is graded B (83/100). Read the Securityscorecard safety report
How do I install Securityscorecard?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Securityscorecard need an API key?
Yes. The registry entry asks for SECURITY_SCORECARD_API_TOKEN.
Is Securityscorecard maintained?
The last commit was in the last day (2026-11-03). The latest release is v2.0.0.
How does Securityscorecard compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,255 servers); tools 9 (the typical server has 7); tools that change things 22% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.