scorecard_mcp

This is an example MCP server for OpenSSF Scorecard.

You can use it to ask questions like:

Is urllib3/urllib3 secure?

Or:

What security best practices does node-semver follow?

Installation

There are several ways to install, depending on what editor you're using; see the installation instructions on the example fetch MCP server.

I recommend using:

...
    "command": "uxv",
    "args": ["scorecard_mcp"]
...

So if you're using Visual Studio Code you'd create a .vscode/ directory in your project and add a mcp.json file that looks like this:

{
    "servers": {
        "scorecard": {
            "type": "stdio",
            "command": "uvx",
            "args": ["scorecard_mcp"]
        }
    }
}