SSC MCP Server

A community-built, comprehensive Model Context Protocol (MCP) server that integrates with theSecurityScorecard API. It runs over stdio, so it works with any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and others.

Published on npm as@callmarcus/securityscorecard-mcpand listed in theMCP Registryasio.github.CallMarcus/securityscorecard-mcp.

Disclaimer:This is an independent, community-built open-source project. It isnot affiliated with, endorsed by, sponsored by, or associated with SecurityScorecard, Inc.in any way. It is built solely against SecurityScorecard's publicly available API documentation. "SecurityScorecard" and all related names, marks, and logos are trademarks of SecurityScorecard, Inc. and are used here for identification purposes only. You must supply your own API credentials and comply with SecurityScorecard's terms of service.
- Node.js 20+-Download
- SecurityScorecard API Token- Get from yourSecurityScorecard dashboard

{ "mcpServers": { "security-scorecard": { "command": "npx", "args": ["-y", "@callmarcus/securityscorecard-mcp"], "env": { "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here", "COMPANY_DOMAIN": "example.com" } } } }

Replace the credentials with your own, then restart the client.

Claude Code— add it from the CLI instead:

claude mcp add security-scorecard \ --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here \ --env COMPANY_DOMAIN=example.com \ -- npx -y @callmarcus/securityscorecard-mcp

On Windows, wrap the launcher incmd /c:... -- cmd /c npx -y @callmarcus/securityscorecard-mcp.

VS Code(Copilot) — uses aserverskey with an explicittype, in.vscode/mcp.json:

{ "servers": { "security-scorecard": { "type": "stdio", "command": "npx", "args": ["-y", "@callmarcus/securityscorecard-mcp"], "env": { "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here", "COMPANY_DOMAIN": "example.com" } } } }

Option B — Run from source (for development)

# Clone the repository git clone https://github.com/CallMarcus/security-scorecard-mcp.git cd security-scorecard-mcp # Install dependencies npm install # Build (use build:fast to avoid memory issues) npm run build:fast

Then point your MCP client at the local build. For clients that use themcpServersformat (Claude Desktop, Cursor, …):

{ "mcpServers": { "security-scorecard": { "command": "node", "args": ["/path/to/security-scorecard-mcp/build/index.js"], "env": { "SECURITY_SCORECARD_API_TOKEN": "your-api-token-here", "COMPANY_DOMAIN": "example.com" } } } }

Important:Replace the path and credentials with your actual values, then restart your MCP client. (For Claude Code, runclaude mcp add security-scorecard --env SECURITY_SCORECARD_API_TOKEN=your-api-token-here -- node /path/to/security-scorecard-mcp/build/index.js.)

The server (index.js) provides 9 specialized tools:

Each tool supports three response modes for token efficiency:

- minimal- Quick answers (15-50 tokens)
- standard- Overview with context (200-300 tokens)
- detailed- Comprehensive analysis (800+ tokens)

REQUEST_CACHE_TTL_MS=300000 REQUESTS_PER_INTERVAL=5 REQUEST_INTERVAL_MS=1000

The server includes hybrid search (semantic + keyword) for finding SecurityScorecard API endpoints:

Use api_discovery to search for "email security"

This searches 517 indexed endpoints and returns matching paths with confidence scores, required parameters, and curl examples.

To update the API reference after changes:

npm run api:embed # Regenerate semantic embeddings npm run api:update # Regenerate docs + embeddings

npm run build:fast # Recommended - uses esbuild (~130ms) npm run build # TypeScript compiler (may OOM on some systems) npm test # Run tests

src/ index.ts # MCP server (9 tools) api/client.ts # SecurityScorecard API client integration/ # API discovery system docs/api/ # Self-contained API reference index.jsonl # Endpoint index (517 endpoints) index-embeddings.json # Semantic search embeddings build/ # Compiled JavaScript

rm -rf node_modules npm install npm run build:fast

Semantic search degrades to keyword-only (Windows + WSL)

Install for the platform that runs the server. Claude Desktop on Windows launches the server with Windowsnode, so ifnpm installran under WSL the native modules (onnxruntime-node,sharp) only have linux binaries — the embeddings layer fails to load andapi_discoverysilently degrades to keyword-only search (results still come back, but confidence scoring is cruder). Runnpm install && npm run build:fastfrom PowerShell or cmd in the repo directory instead — or keep two clones, one per platform.
- Double-check the config file location for your client (seeQuick Start)
- For a from-source install, verify the path tobuild/index.jsis correct
- Restart the client completely
- Sanity-check that the server starts on its own:npx -y @callmarcus/securityscorecard-mcp(it should launch and wait silently on stdio)

- SecurityScorecard API Docs
- Model Context Protocol
- Report Issues

Behavioral trust layer for the AI agent economy. Check MCP server reliability scores, report interactions, detect anomalies, and discover the most trusted servers. 8 tools, free, real-time.