mcpscoreFrom your terminal
MCP audit CLI guideuvx mcpscore 'https://your-server.example/mcp'150+ deterministic checks · one actionable score
Audit your MCP server in seconds
mcpscore is a deterministic MCP server auditor. Get a 0–100 view of protocol conformance, tool and schema quality, observable security and auth posture, and spec readiness — with actionable recommendations.
Run it where you work
Check a server locally, gate a pull request, or share the same report from the web.
See how the score is calculated in the MCP server audit methodology and inspect every check in the audit rules reference.
- Deterministic — no LLM judging
- No API key or sign-up
- Never invokes your tools
In every pull request
MCP audit GitHub Action guide- uses: mcp-box/mcpscore-action@v1
with:
target: https://your-server.example/mcp
min-score: 8074
Protocol95
Primitives90
Security & Auth42
Readiness67
What to fix first
Your server works, but it isn’t ready to ship. Fix the Security & Auth gaps first, then follow your prioritized MCP 2026-07-28 migration checklist—both generated from this audit.
What mcpscore checks
One repeatable view of server quality
The audit connects as a real MCP client, inspects protocol and catalog evidence, and applies deterministic checks across protocol, primitives, security and auth, and readiness.
Every result links back to the public MCP audit methodology and complete rules reference.
Use the right tool
An audit is not every kind of test
mcpscore does not invoke your tools, inspect source code or dependencies, or certify that a server is vulnerability-free. Official conformance tests, MCP Inspector v2, and security scanners answer different questions and often belong beside it.
Compare MCP server testing toolsFrom the blog
Latest posts
MCP Apps in the registry: 869 servers, and the five ways their UIs break
We audited the 16,852 servers in the official MCP Registry that answered in October: 869 serve MCP Apps, and 68 have findings, 66 of them spec violations. How Apps work, how a host loads one, each failure with a real example and its fix.
Skills over MCP: 21 checks, run on Hugging Face's 25 skills
What the MCP Skills extension (SEP-2640) requires of a server, the 21 rules mcpscore 1.27.0 checks, and what they found in the skills Hugging Face serves.
The LiteLLM MCP auth bypass, and the one request that shows it
CVE-2026-59822 let any bearer token into LiteLLM's MCP endpoint. Why 1.83.9 is not enough, what the MCP spec requires, and the mcpscore 1.25.0 check that sends a made-up token.
