mcpscoreBlog
Release notes, migration guidance, and what we learn from scoring MCP servers in the wild.
Subscribe via RSSShowing all 13 posts
We audited the 16,852 servers in the official MCP Registry that answered in October: 869 serve MCP Apps, and 68 have findings, 66 of them spec violations. How Apps work, how a host loads one, each failure with a real example and its fix.
Read articleWhat the MCP Skills extension (SEP-2640) requires of a server, the 21 rules mcpscore 1.27.0 checks, and what they found in the skills Hugging Face serves.
Read articleCVE-2026-59822 let any bearer token into LiteLLM's MCP endpoint. Why 1.83.9 is not enough, what the MCP spec requires, and the mcpscore 1.25.0 check that sends a made-up token.
Read articleWhich OWASP MCP Top 10 risks you can check on a running server, and the three mcpscore 1.22.0 rules that catch hidden text, embedded secrets and injection phrasing in your catalog.
Read articleHow DNS rebinding reaches MCP servers on your laptop or network, how to reproduce it, how mcpscore detects it, and the Origin fix in the Python and TypeScript SDKs.
Read articleWhat SARIF is, why a linter should emit it, and how mcpscore 1.14.0 turns MCP audit findings into GitHub code scanning alerts with one flag and one Action input.
Read articleCompare WebMCP and MCP: page tools vs server integrations, shared schemas, browser support, permissions, and when to use each.
Read articleTurn rules off and re-rank the rest with a mcpscore.toml, gate CI on severity, and keep the badge canonical. Per-project rule configuration in mcpscore 1.12.0.
Read articleSmoke-test real MCP tool calls after every change with mcpscore 1.11.0, while keeping invocation opt-in, deterministic, and separate from the quality score.
Read articleCompare mcpscore with official MCP conformance tests, Inspector v2, and security scanners—and learn which MCP testing tool to use for each job.
Read articleRun the same deterministic MCP audit against Go, Java, C#, Rust, or any other local stdio server, with secret-safe environment configuration.
Read articleThe new MCP release changes the protocol lifecycle, transport, caching, and schemas. See what changed and use mcpscore to find migration gaps.
Read articleAfter five months of building through 0.x, our first stable release brings 52-rule MCP server audits to the CLI, CI, and the web.
Read article