Mmcp.market

Scorecard MCP server

by davidmosiah·io.github.davidmosiah/mcp-scorecard·v0.5.1
No reviews yet

Agent-readiness scorecard for any MCP server: 10 checks, 0-100 score, actionable findings.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Scorecard yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Scorecard tools (1)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • audit

    Grade an MCP server's agent-readiness and security. Accepts an npm package name, a GitHub repo URL, a local dist path (→ stdio protocol-quality checks), or a hosted https:// URL (→ web security + agent-readiness checks). Returns a 0–100 score, an A–F grade, itemized checks, and actionable fixes.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan55 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 19 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the Scorecard repository's README, as published. We do not edit it. Read it on GitHub

mcp-scorecard

Agent-readiness scorecard for any MCP server. Probes a target over stdio, runs 10 checks, outputs a 0-100 score with itemized findings.

Quick start

# Audit a published npm package
npx -y mcp-scorecard whoop-mcp-unofficial

# Audit a GitHub repo (auto-resolves to the published npm package, or local dist)
npx -y mcp-scorecard https://github.com/davidmosiah/whoop-mcp

# Audit a local build (entry file or package directory)
npx -y mcp-scorecard /Users/you/Desktop/my-mcp/dist/index.js
npx -y mcp-scorecard ./my-mcp          # resolves package.json bin/main
npx -y mcp-scorecard ./dist/index.js   # relative paths work offline

# CI gate: fail the build if the score drops
npx -y mcp-scorecard my-mcp --min-score 80

# Structured JSON for piping into your own tooling
npx -y mcp-scorecard my-mcp --json

# Run scorecard itself as an MCP server (stdio default)
npx -y mcp-scorecard serve

# Same server on Streamable HTTP — v2 stateless, loopback only
npx -y mcp-scorecard serve --http
# GET  http://127.0.0.1:3000/health
# POST http://127.0.0.1:3000/mcp   (sessionless)

Env for HTTP: MCPSCORECARDHOST, MCPSCORECARDPORT, MCPSCORECARDTRANSPORT=http.

Demo

Real captured run auditing the official MCP reference server @modelcontextprotocol/server-everything — nothing here is hand-edited, this is exactly what the CLI printed:

$ npx -y mcp-scorecard @modelcontextprotocol/server-everything

# mcp-scorecard - @modelcontextprotocol/server-everything @2026.1.26

**Agent-readiness score:** 44/100

- [PASS] Schema validity              (13/13 tools have valid input schema)
- [FAIL] Tool naming convention       (12/13 tools violate snake_case)
- [FAIL] Privacy modes documented     (only 1 tool(s) mention privacy modes)
- [PASS] Mutation gating              (no write tools — n/a)
- [FAIL] Agent manifest               (no agent_manifest tool)
- [FAIL] Smoke test                   (no smoke script and no test script)
- [PASS] Resources advertised         (7 resources registered)
- [PASS] Tool descriptions            (avg 88 chars across 13 tools)
- [FAIL] Annotations                  (0/13 read tools annotated)
- [FAIL] Manifest discoverability     (no discovery tools)

## Details

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

Runs npx -y mcp-scorecard on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-scorecard -- npx -y mcp-scorecard
Add to Cursor

Scorecard: common questions

Is Scorecard MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Scorecard safety report
How do I install Scorecard?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Scorecard need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Scorecard maintained?
The last commit was 19 days ago (2026-09-07). The latest release is v0.5.1.
What can I use instead of Scorecard?
Servers from other publishers that do the same job: Doc Bridge MCP server and Claudinho MCP server.

Alternatives to Scorecard

Same job from other publishers: the closest match first, then the best rated.

  • Doc Bridge
    Resolve documentation ownership, edit roots, checks, and human handoffs before an agent edits code.
    A
  • Claudinho
    Live 2026 World Cup scores, fixtures & standings for your AI agent. No keys. Unofficial fan project.
    A
Scorecard vs Doc BridgeScorecard vs Claudinho

More from davidmosiah →