Log inSubmit server
Agentscore MCP Server logo

Agentscore MCP Server

by Thezenmonster

Scan MCP packages, assess trust, trace dependency exposure, and add GitHub Actions policy gates without an API key.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Agentscore MCP Server

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "thezenmonster-agentscore-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@agentscore-xyz/mcp-server"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

Thezenmonster/agentscore-mcp-server MCP server evaluates npm-based MCP packages for security risks and trust signals. It provides package scans, allow/warn/block verdicts, monitoring history, abuse checks, dependency exposure analysis, and repository-wide MCP dependency checks. It can also generate or write a GitHub Actions Policy Gate workflow using GitHub OIDC, with no API key required. Use it before installing an MCP package, during incident response, or when enforcing MCP dependency policy in CI.

Use cases

  • Scan an MCP package before installation
  • Check which MCP servers depend on a compromised package
  • Review MCP dependency verdicts in a repository
  • Generate a GitHub Actions policy gate
  • Query abuse reports for a package or agent

Key features

  • npm package security scanning
  • allow, warn, or block trust verdicts
  • MCP dependency exposure analysis
  • continuous monitoring status and scan history
  • repository-wide MCP dependency checks
  • GitHub Actions Policy Gate setup

Tools8

What Agentscore MCP Server lets your agent do. Expand a tool for its parameters.

Verified live~924 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

8/9 checks healthy over the last 90d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 4d ago via OSV.dev · @agentscore-xyz/mcp-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads303Package downloads in the last 30 days.
Last commit6mo agoMost recent push to the default branch.
Tools exposed8Callable tools this server registers over MCP.
Directory activity4 viewsConfig copies, upvotes, and views on AllMCPs.

How Agentscore MCP Server works

What Thezenmonster/agentscore-mcp-server MCP server does

Thezenmonster/agentscore-mcp-server MCP server connects an MCP client to AgentScore’s package security and monitoring data for npm-based MCP packages. It helps developers decide whether to install or connect to a package, understand the security findings behind that decision, and identify other monitored MCP servers that may be affected by a dependency incident.

A package scan returns a score from 0 to 100, a risk level, and findings. The checks cover install-time scripts, prompt-injection patterns, suspicious URLs, source-code indicators such as command injection or unsafe evaluation, hardcoded secrets, dependency count, metadata completeness, publisher provenance, and extracted MCP tool definitions. Trust verdicts classify packages as allow, warn, or block based on scan results and severity, while also reporting monitoring and publisher information.

Tools and capabilities

Thezenmonster/agentscore-mcp-server exposes eight tools:

  • scan_package performs a detailed security scan of an npm package.
  • get_verdict returns an allow, warn, or block decision with related trust details.
  • check_exposure finds monitored MCP servers that depend on a specified package, which supports incident blast-radius analysis.
  • check_abuse queries the KYA abuse database for reports about a package or agent.
  • monitor_status shows whether a package is monitored, along with its current score, risk level, scan history, and recent changes.
  • check_my_repo inspects the current repository for MCP dependencies and summarizes their AgentScore verdicts.
  • generate_policy_gate_setup produces the GitHub Actions YAML needed for an OIDC-based Policy Gate.
  • install_policy_gate writes that workflow to .github/workflows/agentscore-policy-gate.yml.

How it works

Run the server through an MCP client using the npm package. The client can then call individual tools with package names or use repository-aware tools from the current project. Monitoring and exposure results use AgentScore’s live dataset of monitored MCP packages.

For CI enforcement, first inspect the repository with check_my_repo. You can preview the workflow with generate_policy_gate_setup or have install_policy_gate create the workflow file directly. The generated gate uses GitHub OIDC authentication and is designed to auto-provision the repository on its first push; the repository still needs the resulting file committed and pushed.

Risk scores map to LOW for 85–100, MODERATE for 70–84, ELEVATED for 50–69, HIGH for 30–49, and CRITICAL for 0–29.

Setup and configuration

Thezenmonster/agentscore-mcp-server requires no API key and is described as zero configuration. For Claude Desktop, add an MCP server entry that runs npx -y @agentscore-xyz/mcp-server. Cursor and other MCP clients can start it with npx @agentscore-xyz/mcp-server.

The repository does not document required environment variables. The policy workflow uses GitHub OIDC rather than an API key or stored secret.

Limitations and notes

The scanner evaluates published package signals and reported data; its results are security checks and trust decisions, not a guarantee that a package is safe. Exposure and monitoring features apply to packages in AgentScore’s monitored dataset. The policy-gate installation tool writes into the current repository, so review the generated workflow before committing it.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Agentscore MCP Server

Thezenmonster/agentscore-mcp-server is an MCP server that connects AI clients to AgentScore’s npm package security and monitoring data. Its main tools scan packages, return allow/warn/block verdicts, check dependency exposure and abuse reports, inspect repository MCP dependencies, and create or install a GitHub Actions Policy Gate without an API key.

Install it by running the npm package with npx: `npx @agentscore-xyz/mcp-server`. In Claude Desktop, configure the server with `command: "npx"` and arguments `-y @agentscore-xyz/mcp-server`; Cursor and other MCP clients can start the npx command directly.

No, it does not require an API key.

Use `generate_policy_gate_setup` to preview the OIDC-based workflow or `install_policy_gate` to write `.github/workflows/agentscore-policy-gate.yml` to the repository. Commit and push the file; the first workflow run auto-provisions the repository through GitHub OIDC.

Use `check_exposure` with the affected package name. It checks AgentScore’s monitored dataset and reports which monitored MCP servers depend on that package, helping identify the potential blast radius.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAgentscore MCP Server AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/thezenmonster-agentscore-mcp-server?style=directory)](https://allmcps.com/mcp/thezenmonster-agentscore-mcp-server)
HTML Embed
<a href="https://allmcps.com/mcp/thezenmonster-agentscore-mcp-server"><img src="https://allmcps.com/api/badge/thezenmonster-agentscore-mcp-server?style=directory" alt="Agentscore MCP Server on AllMCPs" /></a>