How do I use scorecard_mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@scorecard_mcp What is the OpenSSF Scorecard for the expressjs/express project?" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

scorecard_mcp

Install with uvx in VS Code

This is an example MCP server for OpenSSF Scorecard.

You can use it to ask questions like:

Is urllib3/urllib3 secure?

That's not an endorsement of asking a LLM with limited context if something is secure, but if users are going to ask they should get back an answer informed by context. A better phrased question would be:

What security best practices does node-semver follow?

Installation

There are several ways to install, depending on what editor you're using; see the installation instructions on the example fetch MCP server.

I recommend using:

...
    "command": "uxv",
    "args": ["scorecard-mcp"]
...

So if you're using Visual Studio Code you'd create a .vscode/ directory in your project and add a mcp.json file that looks like this:

{
    "servers": {
        "scorecard": {
            "type": "stdio",
            "command": "uvx",
            "args": ["scorecard-mcp"]
        }
    }
}