security_dashboardLABSCO SUMMARY
Three response modes, so a quick answer costs a quick answer.
Minimal at 15–50 tokens versus detailed at 800+ is a real difference when a model is calling these in a loop, and few servers expose that choice at all. api_discovery is the other unusual piece: 517 endpoints indexed for semantic search, so finding the right one is a question rather than a documentation crawl.
What it is
A community-built MCP server for the SecurityScorecard API. It runs over stdio, so any MCP-compatible client can launch it, and it ships its own searchable index of the API rather than making you read the reference.
What you get
- security_dashboard — score, grade and key security metrics
- analyze_security_risks — issue prioritisation and risk analysis
- create_improvement_plan — an actionable remediation roadmap
- discover_assets — asset inventory with security context
- analyze_email_security — SPF, DMARC and DKIM analysis
- api_discovery — hybrid semantic and keyword search across 517 indexed API endpoints, returning paths with confidence scores, required parameters and curl examples
- analyze_issue_types — granular issue type breakdowns
- validate_data_completeness — cross-tool data verification
- query_security_data — direct API access with discovery
- Every tool takes a response mode: minimal (15–50 tokens), standard (200–300) or detailed (800+)
Requirements
Node.js 20+ and the npm package @callmarcus/securityscorecard-mcp, run with npx -y. SECURITY_SCORECARD_API_TOKEN is required and is your own SecurityScorecard token; COMPANY_DOMAIN optionally sets a default domain for queries and DEBUG_MODE turns on verbose logging. Optional throttling and caching knobs are REQUEST_CACHE_TTL_MS, REQUESTS_PER_INTERVAL and REQUEST_INTERVAL_MS. On Windows, install for the platform that runs the server: an install done under WSL leaves the native modules linux-only, and api_discovery quietly falls back to keyword-only search. This is an independent community project, not affiliated with SecurityScorecard, Inc.
Setup effort
One command plus a key — npx -y @callmarcus/securityscorecard-mcp, then supply credentials
USE CASES
01
Getting a read on a company's security posture
Pull the score and grade, then prioritise what is actually driving it down.
02
Turning findings into work
Generate a remediation roadmap from the prioritised issues.
03
Checking email authentication
Analyse SPF, DMARC and DKIM for the domain in one call.
04
Reaching part of the API these tools do not cover
Search the indexed endpoints for what you need, then query it directly.
9 tools
Listed in project docs. Your client may show a different list.
analyze_security_riskscreate_improvement_plandiscover_assetsanalyze_email_securityapi_discoveryanalyze_issue_typesvalidate_data_completenessquery_security_dataBEFORE YOU INSTALL
What to know first
Tools you get
9 tools named in the project's documentation.
Requires
- npx on PATH
- SECURITY_SCORECARD_API_TOKEN in your environment
Where it runs
All 6 documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @callmarcus/securityscorecard-mcpMCP Clients
Claude Desktop, Cursor, Cline, Windsurf
JSON
{
"mcpServers": {
"security-scorecard": {
"command": "npx",
"args": [
"-y",
"@callmarcus/securityscorecard-mcp"
],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "<YOUR_SECURITY_SCORECARD_API_TOKEN>",
"COMPANY_DOMAIN": "<YOUR_COMPANY_DOMAIN>"
}
}
}
}Claude Code
CLAUDE CODE · TERMINAL
claude mcp add security-scorecard --env SECURITY_SCORECARD_API_TOKEN=<YOUR_SECURITY_SCORECARD_API_TOKEN> --env COMPANY_DOMAIN=<YOUR_COMPANY_DOMAIN> -- npx -y @callmarcus/securityscorecard-mcpVS Code
VS CODE · JSON
{
"servers": {
"security-scorecard": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@callmarcus/securityscorecard-mcp"
],
"env": {
"SECURITY_SCORECARD_API_TOKEN": "<YOUR_SECURITY_SCORECARD_API_TOKEN>",
"COMPANY_DOMAIN": "<YOUR_COMPANY_DOMAIN>"
}
}
}
}
