Securityscorecard MCP Server

Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).

Local serverstdioTypeScript

What is the Securityscorecard MCP server?

Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial). That is what the securityscorecard mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.

The short version

A community-built, comprehensive Model Context Protocol (MCP) server that integrates with the SecurityScorecard API. It runs over stdio, so it works with any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and others.

Getting it running

@callmarcus/securityscorecard-mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

The tools it exposes

The server publishes 11 tools. What each one is for:

  • security_dashboard — Score, grade, and key security metrics
  • analyze_security_risks — Issue prioritization and risk analysis
  • create_improvement_plan — Actionable remediation roadmaps
  • discover_assets — Asset inventory with security context
  • analyze_email_security — SPF/DMARC/DKIM analysis
  • api_discovery — Search 507 API endpoints with hybrid semantic/keyword search
  • analyze_issue_types — Granular issue type breakdowns
  • validate_data_completeness — Cross-tool data verification
  • query_security_data — Direct API access with discovery
  • Prerequisites — The Prerequisites tool exposed by this server
  • Testing — The Testing tool exposed by this server

What it needs from you

Configuration is passed through the environment: SECURITY_SCORECARD_API_TOKEN, COMPANY_DOMAIN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

  1. Node.js 20+ - Download 2. SecurityScorecard API Token - Get from your SecurityScorecard dashboard

Things to watch

  • It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
  • With 11 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Securityscorecard.
  • Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
  • Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

How it compares

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Securityscorecard's toolset — security_dashboard, analyze_security_risks, create_improvement_plan and 8 more — is a fair guide to whether it matches your workflow. It is maintained by CallMarcus; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Available tools

ToolWhat it does
security_dashboardScore, grade, and key security metrics
analyze_security_risksIssue prioritization and risk analysis
create_improvement_planActionable remediation roadmaps
discover_assetsAsset inventory with security context
analyze_email_securitySPF/DMARC/DKIM analysis
api_discoverySearch 507 API endpoints with hybrid semantic/keyword search
analyze_issue_typesGranular issue type breakdowns
validate_data_completenessCross-tool data verification
query_security_dataDirect API access with discovery
PrerequisitesThe Prerequisites tool exposed by this server.
TestingThe Testing tool exposed by this server.

How to install the Securityscorecard MCP server

{
  "mcpServers": {
    "security-scorecard": {
      "command": "npx",
      "args": ["-y", "@callmarcus/securityscorecard-mcp"],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
        "COMPANY_DOMAIN": "example.com"
      }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

  1. Node.js 20+ - Download 2. SecurityScorecard API Token - Get from your SecurityScorecard dashboard
VariableDescriptionRequired
SECURITY_SCORECARD_API_TOKENCredential the server authenticates with.Yes
COMPANY_DOMAINConfiguration value read at startup.Optional

Example prompts to try

  • Use Securityscorecard to security dashboard.
  • Use Securityscorecard to analyze security risks.
  • Use Securityscorecard to create improvement plan.

Frequently asked questions

It connects Securityscorecard to MCP-compatible AI assistants such as Claude and Cursor, exposing 11 tools (security_dashboard, analyze_security_risks, create_improvement_plan, and more) that the assistant can call on your behalf. Instead of copying data back and forth by hand, the assistant works with Securityscorecard directly.