# Thezenmonster/agentscore-mcp-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Thezenmonster/agentscore-mcp-server  
**GitHub Stars:** 1  
**npm Downloads (last month):** 303  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/thezenmonster-agentscore-mcp-server

## Description
MCP security trust layer. Continuously monitors 800+ MCP packages on npm for install scripts, command injection, hardcoded secrets, capability drift, and publisher posture. Ships a GitHub Action policy gate for PR-level allow/warn/block decisions with OIDC auto-provisioning. 5 MCP tools, no API key required.

## Tools
Capabilities this server exposes over MCP:

- **scan_package** — Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.
- **get_verdict** — Get a trust verdict for an MCP package: allow, warn, or block. Based on scan findings (score and severity). Also reports monitoring status and publisher posture. Use this before installing or connecting to an MCP server.
- **check_exposure** — Check which monitored MCP servers depend on a given package. Use this during incident response to find blast radius. Example: 'which MCP servers use axios?'
- **check_abuse** — Check if a package or agent has been reported to the KYA abuse database. Returns whether abuse has been reported and any details.
- **monitor_status** — Check if an MCP package is under continuous monitoring and get its scan history. Shows current score, risk level, and recent changes.
- **check_my_repo** — Inspect the current repo for MCP dependencies, look up AgentScore verdicts for each package, and summarise what should be gated in CI. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.
- **generate_policy_gate_setup** — Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the OIDC-based YAML needed for setup. No API key or secret is required.
- **install_policy_gate** — Write the AgentScore Policy Gate workflow file to this repo. Creates .github/workflows/agentscore-policy-gate.yml with OIDC authentication (no API key needed). Detects MCP dependencies and includes them in the workflow. The gate will auto-provision the repo on first push.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "agentscore-mcp-server": {
    "command": "npx",
    "args": ["-y","@agentscore-xyz/mcp-server"]
  }
}
```

## Documentation

## What Thezenmonster/agentscore-mcp-server MCP server does

Thezenmonster/agentscore-mcp-server MCP server connects an MCP client to AgentScore’s package security and monitoring data for npm-based MCP packages. It helps developers decide whether to install or connect to a package, understand the security findings behind that decision, and identify other monitored MCP servers that may be affected by a dependency incident.

A package scan returns a score from 0 to 100, a risk level, and findings. The checks cover install-time scripts, prompt-injection patterns, suspicious URLs, source-code indicators such as command injection or unsafe evaluation, hardcoded secrets, dependency count, metadata completeness, publisher provenance, and extracted MCP tool definitions. Trust verdicts classify packages as allow, warn, or block based on scan results and severity, while also reporting monitoring and publisher information.

## Tools and capabilities

Thezenmonster/agentscore-mcp-server exposes eight tools:

- `scan_package` performs a detailed security scan of an npm package.
- `get_verdict` returns an allow, warn, or block decision with related trust details.
- `check_exposure` finds monitored MCP servers that depend on a specified package, which supports incident blast-radius analysis.
- `check_abuse` queries the KYA abuse database for reports about a package or agent.
- `monitor_status` shows whether a package is monitored, along with its current score, risk level, scan history, and recent changes.
- `check_my_repo` inspects the current repository for MCP dependencies and summarizes their AgentScore verdicts.
- `generate_policy_gate_setup` produces the GitHub Actions YAML needed for an OIDC-based Policy Gate.
- `install_policy_gate` writes that workflow to `.github/workflows/agentscore-policy-gate.yml`.

## How it works

Run the server through an MCP client using the npm package. The client can then call individual tools with package names or use repository-aware tools from the current project. Monitoring and exposure results use AgentScore’s live dataset of monitored MCP packages.

For CI enforcement, first inspect the repository with `check_my_repo`. You can preview the workflow with `generate_policy_gate_setup` or have `install_policy_gate` create the workflow file directly. The generated gate uses GitHub OIDC authentication and is designed to auto-provision the repository on its first push; the repository still needs the resulting file committed and pushed.

Risk scores map to LOW for 85–100, MODERATE for 70–84, ELEVATED for 50–69, HIGH for 30–49, and CRITICAL for 0–29.

## Setup and configuration

Thezenmonster/agentscore-mcp-server requires no API key and is described as zero configuration. For Claude Desktop, add an MCP server entry that runs `npx -y @agentscore-xyz/mcp-server`. Cursor and other MCP clients can start it with `npx @agentscore-xyz/mcp-server`.

The repository does not document required environment variables. The policy workflow uses GitHub OIDC rather than an API key or stored secret.

## Limitations and notes

The scanner evaluates published package signals and reported data; its results are security checks and trust decisions, not a guarantee that a package is safe. Exposure and monitoring features apply to packages in AgentScore’s monitored dataset. The policy-gate installation tool writes into the current repository, so review the generated workflow before committing it.

_Full upstream README: https://allmcps.com/mcp/thezenmonster-agentscore-mcp-server/readme_