# mcpscore

> mcpscore audits any Model Context Protocol (MCP) server and returns a 0–100
> quality score with a concrete list of what to fix — in the spirit of
> Lighthouse for the web. It is free, deterministic (same server → same
> score), needs no API key, runs in seconds, and is read-only: it never calls
> a server's tools, so auditing is side-effect-free. Servers behind OAuth can
> be audited too (bring a token for a full audit, or run credential-free for
> a partial audit of the auth posture, TLS, and transport surface).

Checks are grouped into four categories — Protocol, Tools Quality, Security &
Auth, and Readiness — and every rule cites the MCP spec section or RFC it
enforces. The scoring methodology and rule set are open source (MIT).

## Try it

- CLI, no install: `uvx mcpscore https://your-server.example/mcp`
- Web: paste a server URL at https://mcpscore.dev and get a shareable report
- CI: the GitHub Action `mcp-box/mcpscore-action` fails PRs below a score
  threshold and comments the report
- Badge: embed a live score badge in a README via
  `https://mcpscore.dev/api/v1/servers/badge.svg?url=<server-url>`

## Docs

- [Documentation](https://docs.mcpscore.dev): getting started, CLI reference,
  CI setup
- [Rules](https://docs.mcpscore.dev/rules): every check, its severity, and
  the spec section it cites
- [Methodology](https://docs.mcpscore.dev/methodology): how the score is
  computed and why it is deterministic

## Blog

- [mcpscore 1.3.0: audit stdio servers in any language](https://mcpscore.dev/blog/mcpscore-1-3-0-any-language-stdio):
  audit Go, Java, C#, Rust, and other local MCP servers with generic stdio commands
- [MCP 2026-07-28 is here. Check your migration with mcpscore](https://mcpscore.dev/blog/mcp-2026-07-28-migration):
  what changed in the new MCP release and how to find migration gaps
- [mcpscore 1.1.0 is here! Our first official release](https://mcpscore.dev/blog/mcpscore-1-1-0-first-official-release):
  the first stable mcpscore release, what its 52 rules cover, and how to run it

## API

- `POST https://mcpscore.dev/api/v1/audits` with `{"url": "<server-url>"}` →
  `202` with an `audit_id`; poll `GET /api/v1/audits/{audit_id}` until
  `status` is `completed` for the full scored report (JSON)
- `GET https://mcpscore.dev/api/v1/servers/badge.svg?url=<server-url>` →
  SVG badge with the server's latest score

## Source

- [GitHub](https://github.com/mcp-box/mcpscore): engine + CLI (Python, MIT)
- [GitHub Action](https://github.com/mcp-box/mcpscore-action): CI wrapper
- [PyPI](https://pypi.org/project/mcpscore/): `pip install mcpscore`