Securityscorecard MCP runs on your own machine — the client starts it, so there is no endpoint to ping. 67 installs a week from npm. Last commit 20 Oct 2026.
Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).
Nothing serious here today
Today is the operative word: we check Securityscorecard MCP every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add securityscorecard-mcp -e 'SECURITY_SCORECARD_API_TOKEN=<SECURITY_SCORECARD_API_TOKEN>' -- npx -y @callmarcus/securityscorecard-mcp{
"mcpServers": {
"securityscorecard-mcp": {
"command": "npx",
"args": [
"-y",
"@callmarcus/securityscorecard-mcp"
],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "<SECURITY_SCORECARD_API_TOKEN>"
}
}
}
}[mcp_servers.securityscorecard-mcp]
command = "npx"
args = ["-y", "@callmarcus/securityscorecard-mcp"]
env = { SECURITY_SCORECARD_API_TOKEN = "<SECURITY_SCORECARD_API_TOKEN>" }{
"mcpServers": {
"securityscorecard-mcp": {
"command": "npx",
"args": [
"-y",
"@callmarcus/securityscorecard-mcp"
],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "<SECURITY_SCORECARD_API_TOKEN>"
}
}
}
}{
"servers": {
"securityscorecard-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@callmarcus/securityscorecard-mcp"
],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "<SECURITY_SCORECARD_API_TOKEN>"
}
}
}
}Put your own value in place of
<SECURITY_SCORECARD_API_TOKEN> (SecurityScorecard API token (get one from your SecurityScorecard dashboard)).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
COMPANY_DOMAIN (Optional default company domain for queries (e.g. example.com)).
Alternatives to Securityscorecard MCP
same job, measured the same wayMCP server for querying VirusTotal API with comprehensive security analysis tools.
MCP server for querying VirusTotal API with comprehensive security analysis tools.
HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.
Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or cloud.
A security-focused MCP server for self-hosted n8n Community Edition.
MCP server for DNSFilter's DNS security/filtering API.
Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.
Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.
Securityscorecard MCP — questions
Answers built from our own checks of this server.