io.github.davidmosiah/mcp-scorecard

mcp-scorecard

Agent-readiness scorecard for any MCP server: 10 checks, 0-100 score, actionable findings.

254/wk 8 tools GitHub npm

No known CVEs

No license

Actively maintained

Last commit 4d ago

Works with most clients

Transport: stdio, sse, http

8 tools · ~254 tok

Grade A · 0.1% of 200K ctx

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-davidmosiah-mcp-scorecard": {
      "args": [
        "-y",
        "mcp-scorecard"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-davidmosiah-mcp-scorecard)](https://mcppedia.org/s/io-github-davidmosiah-mcp-scorecard)

Read me

What io.github.davidmosiah/mcp-scorecard does

Agent-readiness scorecard for any MCP server. Probes a target over stdio, runs 10 checks, outputs a 0-100 score with itemized findings.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'mcp-scorecard' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

84/100across 5 weighted dimensions

How we score →

0255075100

−16

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked mcp-scorecard against OSV.dev.

Inventory

Tools (8)

Click any tool to inspect its schema.

~254 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.davidmosiah/mcp-scorecard safe to use?: io.github.davidmosiah/mcp-scorecard has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.davidmosiah/mcp-scorecard?: io.github.davidmosiah/mcp-scorecard supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.davidmosiah/mcp-scorecard do?: io.github.davidmosiah/mcp-scorecard provides 8 tools: Annotations, Demo, Details, Limitations, Roadmap and 3 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.davidmosiah/mcp-scorecard?: io.github.davidmosiah/mcp-scorecard is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.davidmosiah/mcp-scorecard actively maintained?: io.github.davidmosiah/mcp-scorecard is actively maintained — last commit was 4 days ago.

Similar servers

Others in other

View all →

Pi Lean Ctx95

Pi Coding Agent extension (CLI-first) — routes bash/read/grep/find/ls through lean-ctx CLI for strong token savings. Optional MCP bridge can register advanced tools.

3.0k 6

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

55.0k 3

Sigmap94

97% token reduction for AI coding sessions — zero deps, 21 languages, MCP server

531 6

io.github.asklokesh/loki-mode94

Autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio.

997 8

MCP Security Weekly

Get CVE alerts and security updates for io.github.davidmosiah/mcp-scorecard and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Quick start

# Audit a published npm package npx -y mcp-scorecard whoop-mcp-unofficial # Audit a GitHub repo (auto-resolves to the published npm package, or local dist) npx -y mcp-scorecard https://github.com/davidmosiah/whoop-mcp # Audit a local build npx -y mcp-scorecard /Users/you/Desktop/my-mcp/dist/index.js # CI gate: fail the build if the score drops npx -y mcp-scorecard my-mcp --min-score 80 # Structured JSON for piping into your own tooling npx -y mcp-scorecard my-mcp --json

Demo

Real captured run auditing the official MCP reference server @modelcontextprotocol/server-everything — nothing here is hand-edited, this is exactly what the CLI printed:

$ npx -y mcp-scorecard @modelcontextprotocol/server-everything # mcp-scorecard - @modelcontextprotocol/server-everything @2026.1.26 **Agent-readiness score:** 44/100 - [PASS] Schema validity (13/13 tools have valid input schema) - [FAIL] Tool naming convention (12/13 tools violate snake_case) - [FAIL] Privacy modes documented (only 1 tool(s) mention privacy modes) - [PASS] Mutation gating (no write tools — n/a) - [FAIL] Agent manifest (no agent_manifest tool) - [FAIL] Smoke test (no smoke script and no test script) - [PASS] Resources advertised (7 resources registered) - [PASS] Tool descriptions (avg 88 chars across 13 tools) - [FAIL] Annotations (0/13 read tools annotated) - [FAIL] Manifest discoverability (no discovery tools) ## Details ### Tool naming convention - Non-snake_case names: get-annotated-message, get-env, get-resource-links, get-resource-reference, get-structured-content, get-sum, get-tiny-image, gzip-file-as-resource, toggle-simulated-logging, toggle-subscriber-updates ### Annotations - Missing readOnlyHint: echo, get-annotated-message, get-env, get-resource-links, get-resource-reference, get-structured-content, get-sum, get-tiny-image, gzip-file-as-resource, toggle-simulated-logging ## Suggested fixes - Rename tools to lowercase snake_case (a-z, 0-9, _). - Add a `privacy_mode` parameter (summary | structured | raw) on read tools so agents can request only what the ... [View full README on GitHub](https://github.com/davidmosiah/mcp-scorecard#readme)

Frequently Asked Questions

Is io.github.davidmosiah/mcp-scorecard safe to use?

io.github.davidmosiah/mcp-scorecard has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.davidmosiah/mcp-scorecard?

io.github.davidmosiah/mcp-scorecard supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.davidmosiah/mcp-scorecard do?

io.github.davidmosiah/mcp-scorecard provides 8 tools: Annotations, Demo, Details, Limitations, Roadmap and 3 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.davidmosiah/mcp-scorecard?

io.github.davidmosiah/mcp-scorecard is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.davidmosiah/mcp-scorecard actively maintained?

io.github.davidmosiah/mcp-scorecard is actively maintained — last commit was 4 days ago.

Quick start

Demo

Real captured run auditing the official MCP reference server @modelcontextprotocol/server-everything — nothing here is hand-edited, this is exactly what the CLI printed: