Server data from the Official MCP Registry
Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).
Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).
Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.
7 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: SECURITY_SCORECARD_API_TOKEN
Environment variable: COMPANY_DOMAIN
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-callmarcus-securityscorecard-mcp": {
"env": {
"COMPANY_DOMAIN": "your-company-domain-here",
"SECURITY_SCORECARD_API_TOKEN": "your-security-scorecard-api-token-here"
},
"args": [
"-y",
"@callmarcus/securityscorecard-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
A community-built, comprehensive Model Context Protocol (MCP) server for Claude Desktop that integrates with the SecurityScorecard API.
Published on npm as
@callmarcus/securityscorecard-mcpand listed in the MCP Registry asio.github.CallMarcus/securityscorecard-mcp.
Disclaimer: This is an independent, community-built open-source project. It is not affiliated with, endorsed by, sponsored by, or associated with SecurityScorecard, Inc. in any way. It is built solely against SecurityScorecard's publicly available API documentation. "SecurityScorecard" and all related names, marks, and logos are trademarks of SecurityScorecard, Inc. and are used here for identification purposes only. You must supply your own API credentials and comply with SecurityScorecard's terms of service.
No clone or build required. Point Claude Desktop at the published package with npx.
Edit your claude_desktop_config.json:
%APPDATA%\Claude\claude_desktop_config.json~/Library/Application Support/Claude/claude_desktop_config.json{
"mcpServers": {
"security-scorecard": {
"command": "npx",
"args": ["-y", "@callmarcus/securityscorecard-mcp"],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
"COMPANY_DOMAIN": "example.com"
}
}
}
}
npx -y fetches and runs the latest published version automatically. Replace the credentials with your own, then restart Claude Desktop.
# Clone the repository
git clone https://github.com/CallMarcus/security-scorecard-mcp.git
cd security-scorecard-mcp
# Install dependencies
npm install
# Build (use build:fast to avoid memory issues)
npm run build:fast
Then point Claude Desktop at your local build:
{
"mcpServers": {
"security-scorecard": {
"command": "node",
"args": ["/path/to/security-scorecard-mcp/build/index.js"],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "your-api-token-here",
"COMPANY_DOMAIN": "example.com"
}
}
}
}
Important: Replace the path and credentials with your actual values, then restart Claude Desktop.
The server (index.js) provides 9 specialized tools optimized for Claude Desktop:
| Tool | Purpose |
|---|---|
security_dashboard | Score, grade, and key security metrics |
analyze_security_risks | Issue prioritization and risk analysis |
create_improvement_plan | Actionable remediation roadmaps |
discover_assets | Asset inventory with security context |
analyze_email_security | SPF/DMARC/DKIM analysis |
api_discovery | Search 628+ API endpoints with hybrid semantic/keyword search |
analyze_issue_types | Granular issue type breakdowns |
validate_data_completeness | Cross-tool data verification |
query_security_data | Direct API access with discovery |
Each tool supports three response modes for token efficiency:
| Variable | Required | Description |
|---|---|---|
SECURITY_SCORECARD_API_TOKEN | Yes | Your API token |
COMPANY_DOMAIN | No | Default domain for queries |
DEBUG_MODE | No | Set true for verbose logging |
Optional rate limiting and caching:
REQUEST_CACHE_TTL_MS=300000
REQUESTS_PER_INTERVAL=5
REQUEST_INTERVAL_MS=1000
The server includes hybrid search (semantic + keyword) for finding SecurityScorecard API endpoints:
Use api_discovery to search for "email security"
This searches 628 indexed endpoints and returns matching paths with confidence scores, required parameters, and curl examples.
To update the API reference after changes:
npm run api:embed # Regenerate semantic embeddings
npm run api:update # Regenerate docs + embeddings
npm run build:fast # Recommended - uses esbuild (~130ms)
npm run build # TypeScript compiler (may OOM on some systems)
npm test # Run tests
src/
index.ts # MCP server (9 tools)
api/client.ts # SecurityScorecard API client
integration/ # API discovery system
docs/api/ # Self-contained API reference
index.jsonl # Endpoint index (628 endpoints)
index-embeddings.json # Semantic search embeddings
build/ # Compiled JavaScript
npm test # Run test suite
Use the fast build instead:
npm run build:fast
Reinstall dependencies:
rm -rf node_modules
npm install
npm run build:fast
%APPDATA%\Claude\claude_desktop_config.jsonindex.js is correctYour API token is invalid or expired. Get a new one from SecurityScorecard dashboard.
MIT
Be the first to review this server!
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption