@agentscore-xyz/mcp-server

Ask your agent if an npm MCP package is safe to install. A drop-in MCP server that exposes AgentScore's live security data to Claude, Cursor, ChatGPT, and any MCP-compatible client. No API key, zero config, eight tools.

Browse the live data: agentscores.xyz — 1,600+ monitored MCP packages, continuously updated, public correction loop at /scanner/precision.

Why it exists

MCP clients install packages from npm without a security gate. Most users have no way to ask, mid-conversation, "is this package safe?" before they wire it into their agent. This server makes that question askable directly inside the same chat where you discover the package.

It is the machine-readable trust layer behind agentscores.xyz, packaged as an MCP server so any agent can consume it.

Quick start

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "agentscore": {
      "command": "npx",
      "args": ["-y", "@agentscore-xyz/mcp-server"]
    }
  }
}

Cursor / VS Code / any MCP client

npx @agentscore-xyz/mcp-server

What you can ask

The primary use case: trust questions about packages, answered in conversation.

You: "Is exa-mcp-server safe to install?"

Claude: calls get_verdict "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."

You: "Scan @azure-devops/mcp for security issues."

Claude: calls scan_package "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."

You: "The axios package was compromised. Which MCP servers depend on it?"

Claude: calls check_exposure "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."

You: "Is fa-mcp-sdk monitored? What is its history?"

Claude: calls monitor_status "Yes, under continuous monitoring. Latest scan: HIGH risk. Republished 15+ times since the April 25 disclosure with no maintainer engagement on the open issues."

The agent picks the right tool. You ask the question the way you would ask a colleague.

CI enforcement (optional, section 2)

If you want the same trust data as a merge-time policy gate rather than an in-conversation question, the same MCP server can scaffold a GitHub Actions workflow for you.

You: "Check this repo for MCP dependencies and set up a policy gate."

Claude: calls check_my_repo, then install_policy_gate "Found 5 MCP packages in your repo. Workflow written to .github/workflows/agentscore-policy-gate.yml. Commit, push, and the first PR will provision the gate via GitHub OIDC."

Three tools support that flow:

• check_my_repo — inspect the current repo's MCP dependencies.
• generate_policy_gate_setup — preview the OIDC-based GitHub Actions workflow.
• install_policy_gate — write .github/workflows/agentscore-policy-gate.yml directly into the repo.

The gate is the same data, just at a different point in the lifecycle. The primary surface is still the question.

Available tools

| Tool | Question it answers | |------|---------------------| | scan_package | What does the live scan of this package look like, including install scripts, source patterns, capability surface, and findings? | | get_verdict | Should I allow, warn, or block this package? | | check_exposure | Which monitored MCP servers depend on a given package? (Incident response.) | | monitor_status | Is this package under continuous monitoring? What is its scan history? | | check_abuse | Has this package been reported in the KYA abuse database? | | check_my_repo | Inspect the current repo for MCP dependencies and summarise verdicts. | | generate_policy_gate_setup | Preview the OIDC-based GitHub Actions workflow for CI enforcement. | | install_policy_gate | Write the workflow file directly into .github/workflows/. |

Risk levels

| Score | Risk | Meaning | |-------|------|---------| | 85-100 | LOW | Clean or minor issues only | | 70-84 | MODERATE | Some findings, review recommended | | 50-69 | ELEVATED | Significant findings, use with caution | | 30-49 | HIGH | Serious issues, not recommended | | 0-29 | CRITICAL | Do not use |

What the scanner checks

• Install scripts (postinstall/preinstall hooks with network calls or code execution)
• Prompt injection patterns in package metadata
• Suspicious URLs (sketchy TLDs, ngrok, raw IPs)
• Source code patterns (command injection, unsafe eval, hardcoded secrets) with context-aware mitigators
• Publisher provenance (trusted publishing, attestations)
• Dependency count and metadata completeness
• MCP tool definitions extracted from published source

The scanner changelog and false-positive mitigator lineage are public at agentscores.xyz/scanner/precision. Findings get corrected when maintainers raise valid false-positive challenges. The correction history is part of the record, not buried.

Continuous monitoring

AgentScore monitors 1,600+ MCP packages on npm. check_exposure and monitor_status query this live dataset. When a package like axios gets compromised, you can ask mid-conversation which of your MCP servers are affected.

Links

• Live data: agentscores.xyz
• Per-package reports: agentscores.xyz/report/<package>
• Advisory feed: agentscores.xyz/security/advisories (also RSS)
• API docs: agentscores.xyz/docs
• Methodology: agentscores.xyz/methodology
• Scanner precision changelog: agentscores.xyz/scanner/precision
• Embed a badge: agentscores.xyz/badge

Licence

MIT