mcpscoreSkills over MCP: 21 checks, run on Hugging Face's 25 skills
What the MCP Skills extension (SEP-2640) requires of a server, the 21 rules mcpscore 1.27.0 checks, and what they found in the skills Hugging Face serves.
Read articleBlog
Building better MCP servers
Release notes, migration guidance, and what we learn from scoring MCP servers in the wild.
Subscribe via RSSShowing all 12 posts
The LiteLLM MCP auth bypass, and the one request that shows it
CVE-2026-59822 let any bearer token into LiteLLM's MCP endpoint. Why 1.83.9 is not enough, what the MCP spec requires, and the mcpscore 1.25.0 check that sends a made-up token.
Read articleThe OWASP MCP Top 10, and what your server's catalog tells a model
Which OWASP MCP Top 10 risks you can check on a running server, and the three mcpscore 1.22.0 rules that catch hidden text, embedded secrets and injection phrasing in your catalog.
Read articleDNS rebinding and MCP: why nine in ten servers skip the Origin check
How DNS rebinding reaches MCP servers on your laptop or network, how to reproduce it, how mcpscore detects it, and the Origin fix in the Python and TypeScript SDKs.
Read articleSARIF explained: why linters speak it, and how mcpscore 1.14.0 writes it
What SARIF is, why a linter should emit it, and how mcpscore 1.14.0 turns MCP audit findings into GitHub code scanning alerts with one flag and one Action input.
Read articleWebMCP vs MCP: what they share, where they differ
Compare WebMCP and MCP: page tools vs server integrations, shared schemas, browser support, permissions, and when to use each.
Read articlemcpscore 1.12.0: configure the rules your CI scores on
Turn rules off and re-rank the rest with a mcpscore.toml, gate CI on severity, and keep the badge canonical. Per-project rule configuration in mcpscore 1.12.0.
Read articlemcpscore 1.11.0: smoke-test your MCP tools in CI
Smoke-test real MCP tool calls after every change with mcpscore 1.11.0, while keeping invocation opt-in, deterministic, and separate from the quality score.
Read articleMCP server testing tools compared: mcpscore, Conformance, Inspector v2, and security scanners
Compare mcpscore with official MCP conformance tests, Inspector v2, and security scanners—and learn which MCP testing tool to use for each job.
Read articlemcpscore 1.3.0: audit stdio servers in any language
Run the same deterministic MCP audit against Go, Java, C#, Rust, or any other local stdio server, with secret-safe environment configuration.
Read articleMCP 2026-07-28 is here. Check your migration with mcpscore
The new MCP release changes the protocol lifecycle, transport, caching, and schemas. See what changed and use mcpscore to find migration gaps.
Read articlemcpscore 1.1.0 is here! Our first official release
After five months of building through 0.x, our first stable release brings 52-rule MCP server audits to the CLI, CI, and the web.
Read article