Is the securityscorecard-mcp MCP server free to use?

Yes. securityscorecard-mcp is listed on AllMCPs as a free, open Model Context Protocol server you can install into Claude Desktop, Cursor, or any MCP-compatible client.

Is the securityscorecard-mcp MCP server free to use?

Yes. securityscorecard-mcp is listed on AllMCPs as a free, open Model Context Protocol server you can install into Claude Desktop, Cursor, or any MCP-compatible client.

Securityscorecard Mcp

Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Install Config Generator

Choose your client

claude_desktop_config.json

{
  "mcpServers": {
    "securityscorecard-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "-y"
      ]
    }
  }
}

💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Capabilities & Tool Schemas (9)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Securityscorecard Mcp.

security_dashboard

Score, grade, and key security metrics

analyze_security_risks

Issue prioritization and risk analysis

create_improvement_plan

Actionable remediation roadmaps

discover_assets

Asset inventory with security context

analyze_email_security

SPF/DMARC/DKIM analysis

api_discovery

Search 507 API endpoints with hybrid semantic/keyword search

Documentation Overview

SSC MCP Server

A community-built, comprehensive Model Context Protocol (MCP) server that integrates with the SecurityScorecard API. It runs over stdio, so it works with any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and others.

Published on npm as @callmarcus/securityscorecard-mcp and listed in the MCP Registry as io.github.CallMarcus/securityscorecard-mcp.

Disclaimer: This is an independent, community-built open-source project. It is not affiliated with, endorsed by, sponsored by, or associated with SecurityScorecard, Inc. in any way. It is built solely against SecurityScorecard's publicly available API documentation. "SecurityScorecard" and all related names, marks, and logos are trademarks of SecurityScorecard, Inc. and are used here for identification purposes only. You must supply your own API credentials and comply with SecurityScorecard's terms of service.

Quick Start

Prerequisites

Node.js 20+ - Download
SecurityScorecard API Token - Get from your SecurityScorecard dashboard

Option A — Install from npm (recommended)

No clone or build required. The server runs over stdio via npx, so any MCP-compatible client can launch it. npx -y always fetches the latest published version.

Most clients — Claude Desktop, Cursor, Cline, Windsurf, and others — share the same mcpServers JSON. Add this block to the client's MCP config:

config.json

{

  "mcpServers": {

    "security-scorecard": {

      "command": "npx",

      "args": ["-y", "@callmarcus/securityscorecard-mcp"],

      "env": {

        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",

        "COMPANY_DOMAIN": "example.com"

      }

    }

  }

}

Where that config file lives:

Client	Config file
Claude Desktop (Windows)	`%APPDATA%\Claude\claude_desktop_config.json`
Claude Desktop (macOS)	`~/Library/Application Support/Claude/claude_desktop_config.json`
Cursor	`~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project)

Replace the credentials with your own, then restart the client.

Claude Code — add it from the CLI instead:

Terminal

claude mcp add security-scorecard \

  --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here \

  --env COMPANY_DOMAIN=example.com \

  -- npx -y @callmarcus/securityscorecard-mcp

On Windows, wrap the launcher in cmd /c: ... -- cmd /c npx -y @callmarcus/securityscorecard-mcp.

VS Code (Copilot) — uses a servers key with an explicit type, in .vscode/mcp.json:

config.json

{

  "servers": {

    "security-scorecard": {

      "type": "stdio",

      "command": "npx",

      "args": ["-y", "@callmarcus/securityscorecard-mcp"],

      "env": {

        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",

        "COMPANY_DOMAIN": "example.com"

      }

    }

  }

}

Option B — Run from source (for development)

bash

# Clone the repository

git clone https://github.com/CallMarcus/security-scorecard-mcp.git

cd security-scorecard-mcp



# Install dependencies

npm install



# Build (use build:fast to avoid memory issues)

npm run build:fast

Then point your MCP client at the local build. For clients that use the mcpServers format (Claude Desktop, Cursor, …):

config.json

{

  "mcpServers": {

    "security-scorecard": {

      "command": "node",

      "args": ["/path/to/security-scorecard-mcp/build/index.js"],

      "env": {

        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",

        "COMPANY_DOMAIN": "example.com"

      }

    }

  }

}

Important: Replace the path and credentials with your actual values, then restart your MCP client. (For Claude Code, run claude mcp add security-scorecard --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here -- node /path/to/security-scorecard-mcp/build/index.js.)

Available Tools

The server (index.js) provides 9 specialized tools:

Tool	Purpose
`security_dashboard`	Score, grade, and key security metrics
`analyze_security_risks`	Issue prioritization and risk analysis
`create_improvement_plan`	Actionable remediation roadmaps
`discover_assets`	Asset inventory with security context
`analyze_email_security`	SPF/DMARC/DKIM analysis
`api_discovery`	Search 507 API endpoints with hybrid semantic/keyword search
`analyze_issue_types`	Granular issue type breakdowns
`validate_data_completeness`	Cross-tool data verification
`query_security_data`	Direct API access with discovery

Response Modes

Each tool supports three response modes for token efficiency:

minimal - Quick answers (15-50 tokens)
standard - Overview with context (200-300 tokens)
detailed - Comprehensive analysis (800+ tokens)

Environment Variables

Variable	Required	Description
`SECURITY_SCORECARD_API_TOKEN`	Yes	Your API token
`COMPANY_DOMAIN`	No	Default domain for queries
`DEBUG_MODE`	No	Set `true` for verbose logging

Optional rate limiting and caching:

Code

REQUEST_CACHE_TTL_MS=300000

REQUESTS_PER_INTERVAL=5

REQUEST_INTERVAL_MS=1000

API Discovery

The server includes hybrid search (semantic + keyword) for finding SecurityScorecard API endpoints:

Code

Use api_discovery to search for "email security"

This searches 507 indexed endpoints and returns matching paths with confidence scores, required parameters, and curl examples.

To update the API reference after changes:

Terminal

npm run api:embed    # Regenerate semantic embeddings

npm run api:update   # Regenerate docs + embeddings

Development

Build Commands

Terminal

npm run build:fast   # Recommended - uses esbuild (~130ms)

npm run build        # TypeScript compiler (may OOM on some systems)

npm test             # Run tests

Project Structure

Code

src/

  index.ts               # MCP server (9 tools)

  api/client.ts          # SecurityScorecard API client

  integration/           # API discovery system

docs/api/                # Self-contained API reference

  index.jsonl            # Endpoint index (507 endpoints)

  index-embeddings.json  # Semantic search embeddings

build/                   # Compiled JavaScript

Testing

Terminal

npm test             # Run test suite

Troubleshooting

Build fails with out of memory

Use the fast build instead:

Terminal

npm run build:fast

"Cannot find module" errors

Reinstall dependencies:

bash

rm -rf node_modules

npm install

npm run build:fast

Your client doesn't see the server

Double-check the config file location for your client (see Quick Start)
For a from-source install, verify the path to build/index.js is correct
Restart the client completely
Sanity-check that the server starts on its own: npx -y @callmarcus/securityscorecard-mcp (it should launch and wait silently on stdio)

API returns 401 Unauthorized

Your API token is invalid or expired. Get a new one from SecurityScorecard dashboard.

License

MIT

Related MCP Servers

View all in Monitoring View all alternatives

Frequently Asked Questions about Securityscorecard Mcp

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "securityscorecard-mcp": { "command": "npx", "args": ["-y", "securityscorecard-mcp"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Securityscorecard Mcp AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/securityscorecard-mcp?style=directory)](https://allmcps.com/mcp/securityscorecard-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/securityscorecard-mcp"><img src="https://allmcps.com/api/badge/securityscorecard-mcp?style=directory" alt="Securityscorecard Mcp on AllMCPs" /></a>

Technical Specs & Signals

CategoryMonitoring

52Quality signal: Good · 52/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools25/30

Adoption & activity4/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge and attach your website.

Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 📊 Monitoring →Best MCP servers for Monitoring & Observability →Alternatives to Securityscorecard Mcp →Install in Claude Desktop Install in Cursor Install in VS Code

Securityscorecard Mcp

Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Install Config Generator

Choose your client

claude_desktop_config.json

{
  "mcpServers": {
    "securityscorecard-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "-y"
      ]
    }
  }
}

💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Capabilities & Tool Schemas (9)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Securityscorecard Mcp.

security_dashboard

Score, grade, and key security metrics

analyze_security_risks

Issue prioritization and risk analysis

create_improvement_plan

Actionable remediation roadmaps

discover_assets

Asset inventory with security context

analyze_email_security

SPF/DMARC/DKIM analysis

api_discovery

Search 507 API endpoints with hybrid semantic/keyword search

Documentation Overview

SSC MCP Server

Published on npm as @callmarcus/securityscorecard-mcp and listed in the MCP Registry as io.github.CallMarcus/securityscorecard-mcp.

Disclaimer: This is an independent, community-built open-source project. It is not affiliated with, endorsed by, sponsored by, or associated with SecurityScorecard, Inc. in any way. It is built solely against SecurityScorecard's publicly available API documentation. "SecurityScorecard" and all related names, marks, and logos are trademarks of SecurityScorecard, Inc. and are used here for identification purposes only. You must supply your own API credentials and comply with SecurityScorecard's terms of service.

Quick Start

Prerequisites

Node.js 20+ - Download
SecurityScorecard API Token - Get from your SecurityScorecard dashboard

Option A — Install from npm (recommended)

No clone or build required. The server runs over stdio via npx, so any MCP-compatible client can launch it. npx -y always fetches the latest published version.

Most clients — Claude Desktop, Cursor, Cline, Windsurf, and others — share the same mcpServers JSON. Add this block to the client's MCP config:

config.json

{

  "mcpServers": {

    "security-scorecard": {

      "command": "npx",

      "args": ["-y", "@callmarcus/securityscorecard-mcp"],

      "env": {

        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",

        "COMPANY_DOMAIN": "example.com"

      }

    }

  }

}

Where that config file lives:

Client	Config file
Claude Desktop (Windows)	`%APPDATA%\Claude\claude_desktop_config.json`
Claude Desktop (macOS)	`~/Library/Application Support/Claude/claude_desktop_config.json`
Cursor	`~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project)

Replace the credentials with your own, then restart the client.

Claude Code — add it from the CLI instead:

Terminal

claude mcp add security-scorecard \

  --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here \

  --env COMPANY_DOMAIN=example.com \

  -- npx -y @callmarcus/securityscorecard-mcp

On Windows, wrap the launcher in cmd /c: ... -- cmd /c npx -y @callmarcus/securityscorecard-mcp.

VS Code (Copilot) — uses a servers key with an explicit type, in .vscode/mcp.json:

config.json

{

  "servers": {

    "security-scorecard": {

      "type": "stdio",

      "command": "npx",

      "args": ["-y", "@callmarcus/securityscorecard-mcp"],

      "env": {

        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",

        "COMPANY_DOMAIN": "example.com"

      }

    }

  }

}

Option B — Run from source (for development)

bash

# Clone the repository

git clone https://github.com/CallMarcus/security-scorecard-mcp.git

cd security-scorecard-mcp



# Install dependencies

npm install



# Build (use build:fast to avoid memory issues)

npm run build:fast

Then point your MCP client at the local build. For clients that use the mcpServers format (Claude Desktop, Cursor, …):

config.json

{

  "mcpServers": {

    "security-scorecard": {

      "command": "node",

      "args": ["/path/to/security-scorecard-mcp/build/index.js"],

      "env": {

        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",

        "COMPANY_DOMAIN": "example.com"

      }

    }

  }

}

Available Tools

The server (index.js) provides 9 specialized tools:

Tool	Purpose
`security_dashboard`	Score, grade, and key security metrics
`analyze_security_risks`	Issue prioritization and risk analysis
`create_improvement_plan`	Actionable remediation roadmaps
`discover_assets`	Asset inventory with security context
`analyze_email_security`	SPF/DMARC/DKIM analysis
`api_discovery`	Search 507 API endpoints with hybrid semantic/keyword search
`analyze_issue_types`	Granular issue type breakdowns
`validate_data_completeness`	Cross-tool data verification
`query_security_data`	Direct API access with discovery

Response Modes

Each tool supports three response modes for token efficiency:

minimal - Quick answers (15-50 tokens)
standard - Overview with context (200-300 tokens)
detailed - Comprehensive analysis (800+ tokens)

Environment Variables

Variable	Required	Description
`SECURITY_SCORECARD_API_TOKEN`	Yes	Your API token
`COMPANY_DOMAIN`	No	Default domain for queries
`DEBUG_MODE`	No	Set `true` for verbose logging

Optional rate limiting and caching:

Code

REQUEST_CACHE_TTL_MS=300000

REQUESTS_PER_INTERVAL=5

REQUEST_INTERVAL_MS=1000

API Discovery

The server includes hybrid search (semantic + keyword) for finding SecurityScorecard API endpoints:

Code

Use api_discovery to search for "email security"

This searches 507 indexed endpoints and returns matching paths with confidence scores, required parameters, and curl examples.

To update the API reference after changes:

Terminal

npm run api:embed    # Regenerate semantic embeddings

npm run api:update   # Regenerate docs + embeddings

Development

Build Commands

Terminal

npm run build:fast   # Recommended - uses esbuild (~130ms)

npm run build        # TypeScript compiler (may OOM on some systems)

npm test             # Run tests

Project Structure

Code

src/

  index.ts               # MCP server (9 tools)

  api/client.ts          # SecurityScorecard API client

  integration/           # API discovery system

docs/api/                # Self-contained API reference

  index.jsonl            # Endpoint index (507 endpoints)

  index-embeddings.json  # Semantic search embeddings

build/                   # Compiled JavaScript

Testing

Terminal

npm test             # Run test suite

Troubleshooting

Build fails with out of memory

Use the fast build instead:

Terminal

npm run build:fast

"Cannot find module" errors

Reinstall dependencies:

bash

rm -rf node_modules

npm install

npm run build:fast

Your client doesn't see the server

Double-check the config file location for your client (see Quick Start)
For a from-source install, verify the path to build/index.js is correct
Restart the client completely
Sanity-check that the server starts on its own: npx -y @callmarcus/securityscorecard-mcp (it should launch and wait silently on stdio)

API returns 401 Unauthorized

Your API token is invalid or expired. Get a new one from SecurityScorecard dashboard.

License

MIT

Related MCP Servers

View all in Monitoring View all alternatives

Frequently Asked Questions about Securityscorecard Mcp

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "securityscorecard-mcp": { "command": "npx", "args": ["-y", "securityscorecard-mcp"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/securityscorecard-mcp?style=directory)](https://allmcps.com/mcp/securityscorecard-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/securityscorecard-mcp"><img src="https://allmcps.com/api/badge/securityscorecard-mcp?style=directory" alt="Securityscorecard Mcp on AllMCPs" /></a>

Technical Specs & Signals

CategoryMonitoring

52Quality signal: Good · 52/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools25/30

Adoption & activity4/15

Community engagement0/10

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge and attach your website.

Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 📊 Monitoring →Best MCP servers for Monitoring & Observability →Alternatives to Securityscorecard Mcp →Install in Claude Desktop Install in Cursor Install in VS Code

Securityscorecard Mcp

Quick Install

Install Config Generator

Documentation Overview

SSC MCP Server

Quick Start

Prerequisites

Option A — Install from npm (recommended)

Option B — Run from source (for development)

Available Tools

Response Modes

Environment Variables

API Discovery

Development

Build Commands

Project Structure

Testing

Troubleshooting

Build fails with out of memory

"Cannot find module" errors

Your client doesn't see the server

API returns 401 Unauthorized

License

Links

Related MCP Servers

Frequently Asked Questions about Securityscorecard Mcp

AllMCPs Directory Badge

Technical Specs & Signals

Moxie Docs MCP

Own this project?

Share & Embed

Explore more

Securityscorecard Mcp

Quick Install

Install Config Generator

Documentation Overview

SSC MCP Server

Quick Start

Prerequisites

Option A — Install from npm (recommended)

Option B — Run from source (for development)

Available Tools

Response Modes

Environment Variables

API Discovery

Development

Build Commands

Project Structure

Testing

Troubleshooting

Build fails with out of memory

"Cannot find module" errors

Your client doesn't see the server

API returns 401 Unauthorized

License

Links

Related MCP Servers

Frequently Asked Questions about Securityscorecard Mcp

AllMCPs Directory Badge

Technical Specs & Signals

Moxie Docs MCP

Own this project?

Share & Embed

Explore more