Scorecard MCP server
Agent-readiness scorecard for any MCP server: 10 checks, 0-100 score, actionable findings.
1 stars
Reviews
Write oneNobody has reviewed Scorecard yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Scorecard tools (1)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
auditGrade an MCP server's agent-readiness and security. Accepts an npm package name, a GitHub repo URL, a local dist path (→ stdio protocol-quality checks), or a hosted https:// URL (→ web security + agent-readiness checks). Returns a 0–100 score, an A–F grade, itemized checks, and actionable fixes.
Public scan report
scanner v0.1.10 · 2026-11-08 · same rubric, same numbers if you re-run it
- Code scan55 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 3 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Scorecard compares
Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 92/100
- higher than 90% of 4,456 AI and agents servers
- Tools
- 1
- the typical AI and agents server has 7
- Tools that change things
- 0%
- typical: 3%. Fewer write tools means less an agent can break
- GitHub stars
- 1
- more than 50% of 2,733 AI and agents servers
What its tools let an agent do: 1 read
Install Scorecard in Claude Code, Cursor or VS Code
Runs npx -y mcp-scorecard on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add mcp-scorecard -- npx -y mcp-scorecard
What the publisher says
From the Scorecard repository's README, as published. We do not edit it. Read it on GitHub
mcp-scorecard
Agent-readiness scorecard for any MCP server. Probes a target over stdio, runs 10 checks, outputs a 0-100 score with itemized findings.
Quick start
# Audit a published npm package
npx -y mcp-scorecard whoop-mcp-unofficial
# Audit a GitHub repo (auto-resolves to the published npm package, or local dist)
npx -y mcp-scorecard https://github.com/davidmosiah/whoop-mcp
# Audit a local build (entry file or package directory)
npx -y mcp-scorecard /Users/you/Desktop/my-mcp/dist/index.js
npx -y mcp-scorecard ./my-mcp # resolves package.json bin/main
npx -y mcp-scorecard ./dist/index.js # relative paths work offline
# CI gate: fail the build if the score drops
npx -y mcp-scorecard my-mcp --min-score 80
# Structured JSON for piping into your own tooling
npx -y mcp-scorecard my-mcp --json
# Run scorecard itself as an MCP server (stdio default)
npx -y mcp-scorecard serve
# Same server on Streamable HTTP — v2 stateless, loopback only
npx -y mcp-scorecard serve --http
# GET http://127.0.0.1:3000/health
# POST http://127.0.0.1:3000/mcp (sessionless)Env for HTTP: MCPSCORECARDHOST, MCPSCORECARDPORT, MCPSCORECARDTRANSPORT=http.
Demo
Real captured run auditing the official MCP reference server @modelcontextprotocol/server-everything — nothing here is hand-edited, this is exactly what the CLI printed:
$ npx -y mcp-scorecard @modelcontextprotocol/server-everything
# mcp-scorecard - @modelcontextprotocol/server-everything @2026.1.26
**Agent-readiness score:** 44/100
- [PASS] Schema validity (13/13 tools have valid input schema)
- [FAIL] Tool naming convention (12/13 tools violate snake_case)
- [FAIL] Privacy modes documented (only 1 tool(s) mention privacy modes)
- [PASS] Mutation gating (no write tools — n/a)
- [FAIL] Agent manifest (no agent_manifest tool)
- [FAIL] Smoke test (no smoke script and no test script)
- [PASS] Resources advertised (7 resources registered)
- [PASS] Tool descriptions (avg 88 chars across 13 tools)
- [FAIL] Annotations (0/13 read tools annotated)
- [FAIL] Manifest discoverability (no discovery tools)
## DetailsShortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Scorecard: common questions
- Is Scorecard MCP server safe?
- Yes, by our scan: it is graded A (92/100). Read the Scorecard safety report
- How do I install Scorecard?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Scorecard need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Scorecard maintained?
- The last commit was 10 days ago (2026-11-05). The latest release is v0.5.1.
- What can I use instead of Scorecard?
- Servers from other publishers that do the same job: agent-custody MCP server, PDF MCP server and Kiln MCP server.
- How does Scorecard compare with other AI and agents MCP servers?
- safety score 92/100 (higher than 90% of 4,456 AI and agents servers); tools 1 (the typical AI and agents server has 7); tools that change things 0% (typical: 3%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Scorecard
Same job from other publishers: the closest match first, then the best rated.
- agent-custodyMCP gateway that checks each agent tool call against a signed grant and policy, and signs a receiptnot reviewedEstablishedA
- PDFAgentic RAG over your PDFs, with page-level evidence to check every answer.not reviewedEstablishedA
KilnSpawn an object into existence: describe it, and your agent designs it, checks it, and 3D prints it.not reviewedEstablishedB- Vibe CheckMetacognitive AI agent oversight: adaptive CPI interrupts for alignment, reflection and safetynot reviewedEstablishedB
Jev-StyleLocal 2B and 0.8B decision models: calibrated yes/no, choice and score answers for your agent.not reviewedEstablishedB
