MCP.Market

Agentscore MCP server

by Thezenmonster·io.github.Thezenmonster/agentscore·v2.2.0·1 stars
No reviews yet

MCP security trust layer: scan packages, inspect repos, check exposure, monitor changes.

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
New

1 stars83 downloads/wk

Reviews

Write one

Nobody has reviewed Agentscore yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Agentscore tools (8, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_abuse

    Check if a package or agent has been reported to the KYA abuse database. Returns whether abuse has been reported and any details.

  • check_exposure

    Check which monitored MCP servers depend on a given package. Use this during incident response to find blast radius. Example: 'which MCP servers use axios?'

  • check_my_repo

    Inspect the current repo for MCP dependencies, look up AgentScore verdicts for each package, and summarise what should be gated in CI. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.

  • generate_policy_gate_setup

    Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the YAML, secret name, and pilot link needed for setup.

  • get_verdict

    Get a trust verdict for an MCP package: allow, warn, or block. Based on scan findings (score and severity). Also reports monitoring status and publisher posture. Use this before installing or connecting to an MCP server.

  • install_policy_gatewrite action

    Write the AgentScore Policy Gate workflow file to this repo. Creates .github/workflows/agentscore-policy-gate.yml with OIDC authentication (no API key needed). Detects MCP dependencies and includes them in the workflow. The gate will auto-provision the repo on first push.

  • monitor_status

    Check if an MCP package is under continuous monitoring and get its scan history. Shows current score, risk level, and recent changes.

  • scan_package

    Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan10 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 154 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Agentscore compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 66% of 915 Security servers
Tools
8
the typical Security server has 6
Tools that change things
13%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 60% of 587 Security servers
Downloads a week
83
more than 58% of 248 Security servers with a package

What its tools let an agent do: 6 read · 1 create · 1 run or deploy

Install Agentscore in Claude Code, Cursor or VS Code

Runs npx -y @agentscore-xyz/mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add agentscore -- npx -y @agentscore-xyz/mcp-server
Add to Cursor

What the publisher says

From the Agentscore repository's README, as published. We do not edit it. Read it on GitHub

@agentscore-xyz/mcp-server

MCP security trust layer. Scan packages, get trust verdicts, inspect repo-wide MCP dependencies, generate Policy Gate setup, install the CI workflow directly, check incident exposure, and query the abuse database. Eight tools for MCP security decisions. No API key, zero config.

Scan any MCP package for security issues: agentscores.xyz

Quick Start

Claude Desktop

Add to your claudedesktopconfig.json:

{
  "mcpServers": {
    "agentscore": {
      "command": "npx",
      "args": ["-y", "@agentscore-xyz/mcp-server"]
    }
  }
}

Cursor / Any MCP Client

npx @agentscore-xyz/mcp-server

What This Does

Your AI can now make security decisions about MCP packages:

You: "Is exa-mcp-server safe to install?"

Claude: calls getverdict "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including websearchexa and crawlingexa."

You: "The axios package was compromised. Which MCP servers are affected?"

Claude: calls checkexposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."

You: "Scan @azure-devops/mcp for security issues"

Claude: calls scanpackage* "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."

You: "Check this repo for MCP dependencies"

Claude: calls checkmyrepo "MCP dependencies found: 5. Two are warnings. Run generatepolicygate_setup to turn these checks into a CI gate."

You: "Set up AgentScore Policy Gate for this repo"

Claude: calls installpolicygate "The workflow file is written to .github/workflows/agentscore-policy-gate.yml. Commit and push. GitHub OIDC will auto-provision the repo on first run."

Available Tools

From Ad-Hoc Scans To CI Enforcement

The MCP server now bridges one-off package checks into the sticky product:

  1. Run checkmyrepo to see every MCP package used in a repo.
  2. Run generatepolicygate_setup to preview the OIDC-based GitHub Actions workflow.
  3. Run installpolicygate to write the workflow file directly into the repo.
  4. Commit and push. The first run auto-provisions through GitHub OIDC.

That turns "is this package safe?" into "this repo now enforces MCP dependency policy on every PR."

Risk Levels

What the Scanner Checks

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Agentscore: common questions

Is Agentscore MCP server safe?
Mostly: it is graded B (82/100). Read the Agentscore safety report
How do I install Agentscore?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Agentscore need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Agentscore maintained?
The last commit was 191 days ago (2026-04-27). The latest release is v2.2.0.
What can I use instead of Agentscore?
Servers from other publishers that do the same job: pkgxray MCP server, QualityMax QA MCP server and Zn Gate MCP server.
How does Agentscore compare with other Security MCP servers?
safety score 82/100 (higher than 66% of 915 Security servers); tools 8 (the typical Security server has 6); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Agentscore

Same job from other publishers: the closest match first, then the best rated.

  • pkgxray
    Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
    B
  • QualityMax QA MCP
    Final release; the checks moved to 9lives (9l mcp). Local QA MCP: scan, inspect, repro, run tests.
    A
  • Zn Gate
    The local security layer for coding agents: secret redaction, injection checks and an MCP proxy.
    B
  • Jikida
    Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
    A
  • Fedramp Oscal Ssp Lint
    16 checks on a system-security-plan JSON, in your editor, before a validator returns the package
    More from jmshinhwa →
    A