Minimal at 15–50 tokens versus detailed at 800+ is a real difference when a model is calling these in a loop, and few servers expose that choice at all. `api_discovery` is the other unusual piece: 517 endpoints indexed for semantic search, so finding the right one is a question rather than a documentation crawl.
A community-built MCP server for the SecurityScorecard API. It runs over stdio, so any MCP-compatible client can launch it, and it ships its own searchable index of the API rather than making you read the reference.
- security_dashboard — score, grade and key security metrics
- analyze_security_risks — issue prioritisation and risk analysis
- create_improvement_plan — an actionable remediation roadmap
- discover_assets — asset inventory with security context
- analyze_email_security — SPF, DMARC and DKIM analysis
- api_discovery — hybrid semantic and keyword search across 517 indexed API endpoints, returning paths with confidence scores, required parameters and curl examples
- analyze_issue_types — granular issue type breakdowns
- validate_data_completeness — cross-tool data verification
- query_security_data — direct API access with discovery
- Every tool takes a response mode: minimal (15–50 tokens), standard (200–300) or detailed (800+)
Node.js 20+ and the npm package `@callmarcus/securityscorecard-mcp`, run with `npx -y`. `SECURITY_SCORECARD_API_TOKEN` is required and is your own SecurityScorecard token; `COMPANY_DOMAIN` optionally sets a default domain for queries and `DEBUG_MODE` turns on verbose logging. Optional throttling and caching knobs are `REQUEST_CACHE_TTL_MS`, `REQUESTS_PER_INTERVAL` and `REQUEST_INTERVAL_MS`. On Windows, install for the platform that runs the server: an install done under WSL leaves the native modules linux-only, and `api_discovery` quietly falls back to keyword-only search. This is an independent community project, not affiliated with SecurityScorecard, Inc.
One command plus a key — npx -y @callmarcus/securityscorecard-mcp, then supply credentials