Server data from the Official MCP Registry
MCP security trust layer: scan packages, inspect repos, check exposure, monitor changes.
MCP security trust layer: scan packages, inspect repos, check exposure, monitor changes.
This is a well-designed MCP security auditing tool with clean architecture and appropriate permissions. The server calls the AgentScore API to scan npm packages and inspect repositories for MCP dependencies. No authentication is required (zero-config as advertised), file I/O is scoped to repository inspection, and network access is limited to the AgentScore API. Minor code quality improvements suggested around error handling and input validation, but no security vulnerabilities detected. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.
6 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-thezenmonster-agentscore": {
"args": [
"-y",
"@agentscore-xyz/mcp-server"
],
"command": "npx"
}
}
}From the project's GitHub README.
MCP security trust layer. Scan packages, get trust verdicts, inspect repo-wide MCP dependencies, generate Policy Gate setup, install the CI workflow directly, check incident exposure, and query the abuse database. Eight tools for MCP security decisions. No API key, zero config.
Scan any MCP package for security issues: agentscores.xyz
Add to your claude_desktop_config.json:
{
"mcpServers": {
"agentscore": {
"command": "npx",
"args": ["-y", "@agentscore-xyz/mcp-server"]
}
}
}
npx @agentscore-xyz/mcp-server
Your AI can now make security decisions about MCP packages:
You: "Is exa-mcp-server safe to install?"
Claude: calls get_verdict "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."
You: "The axios package was compromised. Which MCP servers are affected?"
Claude: calls check_exposure "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
You: "Scan @azure-devops/mcp for security issues"
Claude: calls scan_package "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."
You: "Check this repo for MCP dependencies"
Claude: calls check_my_repo "MCP dependencies found: 5. Two are warnings. Run generate_policy_gate_setup to turn these checks into a CI gate."
You: "Set up AgentScore Policy Gate for this repo"
Claude: calls install_policy_gate "The workflow file is written to
.github/workflows/agentscore-policy-gate.yml. Commit and push. GitHub OIDC will auto-provision the repo on first run."
| Tool | What it does |
|---|---|
scan_package | Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
get_verdict | Trust decision: allow, warn, or block based on scan findings. Also reports monitoring status and publisher posture. |
check_my_repo | Inspect the current repo for MCP dependencies and summarise verdicts for every package detected locally. |
generate_policy_gate_setup | Generate the exact OIDC-based GitHub Actions workflow needed to enforce Policy Gate in CI. |
install_policy_gate | Write .github/workflows/agentscore-policy-gate.yml directly into the repo so the gate is ready to commit. |
check_exposure | Incident response: which monitored MCP servers depend on a given package? |
check_abuse | Query the KYA abuse database for reported packages or agents |
monitor_status | Check if a package is under continuous monitoring and get scan history |
The MCP server now bridges one-off package checks into the sticky product:
check_my_repo to see every MCP package used in a repo.generate_policy_gate_setup to preview the OIDC-based GitHub Actions workflow.install_policy_gate to write the workflow file directly into the repo.That turns "is this package safe?" into "this repo now enforces MCP dependency policy on every PR."
| Score | Risk | Meaning |
|---|---|---|
| 85-100 | LOW | Clean or minor issues only |
| 70-84 | MODERATE | Some findings, review recommended |
| 50-69 | ELEVATED | Significant findings, use with caution |
| 30-49 | HIGH | Serious issues, not recommended |
| 0-29 | CRITICAL | Do not use |
AgentScore continuously monitors hundreds of MCP packages. The check_exposure and monitor_status tools use this live dataset. When a package like axios gets compromised, you can instantly find which MCP servers are affected.
MIT
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.