Security Scorecard MCP Server: Install & Setup

Install Security Scorecard in Claude Code

Claude Code

claude mcp add security-scorecard -e SECURITY_SCORECARD_API_TOKEN=... -- npx -y @callmarcus/securityscorecard-mcp

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "security-scorecard": {
      "command": "npx",
      "args": [
        "-y",
        "@callmarcus/securityscorecard-mcp"
      ],
      "env": {
        "SECURITY_SCORECARD_API_TOKEN": "..."
      }
    }
  }
}

Replace each ... with your own value.

Frequently asked questions

What does the Security Scorecard MCP server do?

Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).

Is the Security Scorecard MCP server free?

The server is free, but you will likely need an account. The server itself is free, but it connects to a service that needs an account or API key, which may have paid tiers. Check the provider for current pricing.

Does Security Scorecard run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add Security Scorecard to Claude Code?

Run: claude mcp add security-scorecard -e SECURITY_SCORECARD_API_TOKEN=... -- npx -y @callmarcus/securityscorecard-mcp

More security & identity MCP servers

View all

Securitystack

securityscan-api/securitystack-mcp

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

LocalFree

Security

pratham-jain33/security-mcp

Zero-key security toolkit: grade sites A+ to F, check CVE exploits, plain-English attack defenses

LocalFree

selvo

Cope-Labs/selvo

Linux CVE prioritisation: 16 MCP tools for scan, fleet, runtime, and PR-able fix discovery.

LocalFree

SecureNow

03.1k

securenow-ai/securenow-npm

Production security for Node.js apps: investigate live attacks, block IPs, tune detections.

Local + RemoteFree

Sentrik

0118

maxgerhardson/sentrik-community

Governance runtime for AI-generated code. Enforce compliance and security standards.

LocalFree

Secret Scrub

sudo-ai-git/mcp-secret-scrub

Deterministic no-LLM MCP server that scrubs secrets before they reach an agent. Never leaks values.

LocalFree