SSC MCP Server

A community-built, comprehensive Model Context Protocol (MCP) server that integrates with the SecurityScorecard API. It runs over stdio, so it works with any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and others.

Published on npm as @callmarcus/securityscorecard-mcp and listed in the MCP Registry as io.github.CallMarcus/securityscorecard-mcp.

Disclaimer: This is an independent, community-built open-source project. It is not affiliated with, endorsed by, sponsored by, or associated with SecurityScorecard, Inc. in any way. It is built solely against SecurityScorecard's publicly available API documentation. "SecurityScorecard" and all related names, marks, and logos are trademarks of SecurityScorecard, Inc. and are used here for identification purposes only. You must supply your own API credentials and comply with SecurityScorecard's terms of service.

Quick Start

Prerequisites

1. Node.js 18+ - Download
2. SecurityScorecard API Token - Get from your SecurityScorecard dashboard

Option A — Install from npm (recommended)

No clone or build required. The server runs over stdio via npx, so any MCP-compatible client can launch it. npx -y always fetches the latest published version.

Most clients — Claude Desktop, Cursor, Cline, Windsurf, and others — share the same mcpServers JSON. Add this block to the client's MCP config:

{
  "mcpServers": {
    "security-scorecard": {
      "command": "npx",
      "args": ["-y", "@callmarcus/securityscorecard-mcp"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
        "COMPANY_DOMAIN": "example.com"
      }
    }
  }
}

Where that config file lives:

Replace the credentials with your own, then restart the client.

Claude Code — add it from the CLI instead:

claude mcp add security-scorecard \
  --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here \
  --env COMPANY_DOMAIN=example.com \
  -- npx -y @callmarcus/securityscorecard-mcp

On Windows, wrap the launcher in cmd /c: ... -- cmd /c npx -y @callmarcus/securityscorecard-mcp.

VS Code (Copilot) — uses a servers key with an explicit type, in .vscode/mcp.json:

{
  "servers": {
    "security-scorecard": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@callmarcus/securityscorecard-mcp"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
        "COMPANY_DOMAIN": "example.com"
      }
    }
  }
}

Option B — Run from source (for development)

# Clone the repository
git clone https://github.com/CallMarcus/security-scorecard-mcp.git
cd security-scorecard-mcp

# Install dependencies
npm install

# Build (use build:fast to avoid memory issues)
npm run build:fast

Then point your MCP client at the local build. For clients that use the mcpServers format (Claude Desktop, Cursor, …):

{
  "mcpServers": {
    "security-scorecard": {
      "command": "node",
      "args": ["/path/to/security-scorecard-mcp/build/index.js"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN":

... [View full README on GitHub](https://github.com/callmarcus/security-scorecard-mcp#readme)