MCP security trust layer. Scan packages, get trust verdicts, inspect repo-wide MCP dependencies, generate Policy Gate setup, install the CI workflow directly, check incident exposure, and query the abuse database. Eight tools for MCP security decisions. No API key, zero config.
Scan any MCP package for security issues: agentscores.xyz
Add to your claude_desktop_config.json:
{
"mcpServers": {
"agentscore": {
"command": "npx",
"args": ["-y", "@agentscore-xyz/mcp-server"]
}
}
}npx @agentscore-xyz/mcp-serverRelated MCP server: MCP Trust Layer
Your AI can now make security decisions about MCP packages:
You: "Is exa-mcp-server safe to install?"
Claude: calls get_verdict "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."
You: "The axios package was compromised. Which MCP servers are affected?"
Claude: calls check_exposure "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
You: "Scan @azure-devops/mcp for security issues"
Claude: calls scan_package "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."
You: "Check this repo for MCP dependencies"
Claude: calls check_my_repo "MCP dependencies found: 5. Two are warnings. Run generate_policy_gate_setup to turn these checks into a CI gate."
You: "Set up AgentScore Policy Gate for this repo"
Claude: calls install_policy_gate "The workflow file is written to
.github/workflows/agentscore-policy-gate.yml. Commit and push. GitHub OIDC will auto-provision the repo on first run."
Tool | What it does |
| Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
| Trust decision: allow, warn, or block based on scan findings. Also reports monitoring status and publisher posture. |
| Inspect the current repo for MCP dependencies and summarise verdicts for every package detected locally. |
| Generate the exact OIDC-based GitHub Actions workflow needed to enforce Policy Gate in CI. |
| Write |
| Incident response: which monitored MCP servers depend on a given package? |
| Query the KYA abuse database for reported packages or agents |
| Check if a package is under continuous monitoring and get scan history |
The MCP server now bridges one-off package checks into the sticky product:
Run check_my_repo to see every MCP package used in a repo.
Run generate_policy_gate_setup to preview the OIDC-based GitHub Actions workflow.
Run install_policy_gate to write the workflow file directly into the repo.
Commit and push. The first run auto-provisions through GitHub OIDC.
That turns "is this package safe?" into "this repo now enforces MCP dependency policy on every PR."
Score | Risk | Meaning |
85-100 | LOW | Clean or minor issues only |
70-84 | MODERATE | Some findings, review recommended |
50-69 | ELEVATED | Significant findings, use with caution |
30-49 | HIGH | Serious issues, not recommended |
0-29 | CRITICAL | Do not use |
Install scripts (postinstall/preinstall hooks with network calls or code execution)
Prompt injection patterns in package metadata
Suspicious URLs (sketchy TLDs, ngrok, raw IPs)
Source code patterns (command injection, unsafe eval, hardcoded secrets)
Publisher provenance (trusted publishing, attestations)
Dependency count and metadata completeness
MCP tool definitions extracted from published source
AgentScore continuously monitors hundreds of MCP packages. The check_exposure and monitor_status tools use this live dataset. When a package like axios gets compromised, you can instantly find which MCP servers are affected.
Website: agentscores.xyz
API Docs: agentscores.xyz/docs
Methodology: agentscores.xyz/methodology
MIT
Check if a package or agent has been reported to the KYA abuse database. Returns whether abuse has been reported and any details.
Inputs: agent (required).
Check which monitored MCP servers depend on a given package. Use this during incident response to find blast radius. Example: 'which MCP servers use axios?'
Inputs: npm (required).
Inspect the current repo for MCP dependencies, look up AgentScore verdicts for each package, and summarise what should be gated in CI. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.
Inputs: path.
Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the OIDC-based YAML needed for setup. No API key or secret is required.
Inputs: path, repo_url.
Get a trust verdict for an MCP package: allow, warn, or block. Based on scan findings (score and severity). Also reports monitoring status and publisher posture. Use this before installing or connecting to an MCP server.
Inputs: npm (required).
Write the AgentScore Policy Gate workflow file to this repo. Creates .github/workflows/agentscore-policy-gate.yml with OIDC authentication (no API key needed). Detects MCP dependencies and includes them in the workflow. The gate will auto-provision the repo on first push.
Inputs: path, repo_url.
Check if an MCP package is under continuous monitoring and get its scan history. Shows current score, risk level, and recent changes.
Inputs: npm (required).
Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.
Inputs: npm (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 8 tools
Most tools have distinct purposes: scanning, checking verdicts, monitoring, policy enforcement, etc. However, 'install_policy_gate' and 'generate_policy_gate_setup' are closely related (generate vs write workflow), which could cause misselection. Also, 'check_abuse' and 'get_verdict' both return trust-related info but from different sources, which is fine.
Tools use a consistent verb_noun pattern: check_abuse, check_exposure, generate_policy_gate_setup, etc. The only minor inconsistency is 'install_policy_gate' where 'install' could be seen as more specific than 'generate', but still follows the pattern. No mixing of camelCase or other styles.
8 tools is appropriate for an MCP package security server. Each tool covers a core function: scanning, verdict, monitoring, abuse check, exposure analysis, repo check, and policy gate generation/installation. Neither too few nor too many.
The tool set covers key lifecycle operations: scan, get verdict, monitor, check abuse, check exposure, and policy enforcement (generate+install). Missing tools could include updating a verdict or removing a policy gate, but the core workflow is well-covered.
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
npm MCP — wraps the npm Registry API (free, no auth)
Watch MCP tools, package publishers and domains. Free catalog; paid continuing checks.