Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).
Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial). That is what the securityscorecard mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
A community-built, comprehensive Model Context Protocol (MCP) server that integrates with the SecurityScorecard API. It runs over stdio, so it works with any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and others.
@callmarcus/securityscorecard-mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
The server publishes 11 tools. What each one is for:
security_dashboard — Score, grade, and key security metricsanalyze_security_risks — Issue prioritization and risk analysiscreate_improvement_plan — Actionable remediation roadmapsdiscover_assets — Asset inventory with security contextanalyze_email_security — SPF/DMARC/DKIM analysisapi_discovery — Search 507 API endpoints with hybrid semantic/keyword searchanalyze_issue_types — Granular issue type breakdownsvalidate_data_completeness — Cross-tool data verificationquery_security_data — Direct API access with discoveryPrerequisites — The Prerequisites tool exposed by this serverTesting — The Testing tool exposed by this serverConfiguration is passed through the environment: SECURITY_SCORECARD_API_TOKEN, COMPANY_DOMAIN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Securityscorecard's toolset — security_dashboard, analyze_security_risks, create_improvement_plan and 8 more — is a fair guide to whether it matches your workflow. It is maintained by CallMarcus; worth a glance at recent repository activity before you build anything load-bearing on it.
We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.
| Tool | What it does |
|---|---|
| security_dashboard | Score, grade, and key security metrics |
| analyze_security_risks | Issue prioritization and risk analysis |
| create_improvement_plan | Actionable remediation roadmaps |
| discover_assets | Asset inventory with security context |
| analyze_email_security | SPF/DMARC/DKIM analysis |
| api_discovery | Search 507 API endpoints with hybrid semantic/keyword search |
| analyze_issue_types | Granular issue type breakdowns |
| validate_data_completeness | Cross-tool data verification |
| query_security_data | Direct API access with discovery |
| Prerequisites | The Prerequisites tool exposed by this server. |
| Testing | The Testing tool exposed by this server. |
{
"mcpServers": {
"security-scorecard": {
"command": "npx",
"args": ["-y", "@callmarcus/securityscorecard-mcp"],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
"COMPANY_DOMAIN": "example.com"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| SECURITY_SCORECARD_API_TOKEN | Credential the server authenticates with. | Yes |
| COMPANY_DOMAIN | Configuration value read at startup. | Optional |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.