QuietScore

Clear severity. Quiet data. A private CVSS 4.0 calculator with a Rust/WebAssembly scoring engine and MCP tools.

Open calculator · Download offline edition · Source provenance

Capabilities

• Paste and validate a CVSS 4.0 vector, or assess all 32 metrics through a guided wizard.

• Save multiple drafts locally; add optional assessment and metric notes.

• Explore ten attributed vulnerability samples. Published samples are read-only; clone one to start an assessment. Empty metric notes are omitted in read-only mode.

• Export JSON, plain text, PDF, or Excel. JSON restores assessment notes; text restores the vector. PDF uses the browser’s print/save dialog; Excel is a static snapshot.

• Use responsive light, dark, and high-contrast views with keyboard controls and labelled severity cues.

• Use the same engine through local stdio or authenticated hosted MCP: cvss_calculate, cvss_explain, and cvss_metric.

Browser scoring, drafts, imports, and exports stay on the device. No analytics or scoring API calls are made by the calculator. Hosted MCP processes vectors at Cloudflare; AI-client handling and host request metadata have separate privacy boundaries. See Privacy.

CVSS measures vulnerability severity, not exploitation probability or complete business risk. QuietScore is independent of FIRST and is not certified or endorsed by it.

Related MCP server: cve-mcp

Screenshots

Choose a guided assessment, reopen local drafts, or explore published samples.

The wizard explains each classification and captures optional evidence notes.

Published samples include sourced explanations and stay read-only until cloned.

Severity remains clear in dark mode; export the assessment as JSON, text, PDF, or Excel.

Connect AI clients through OAuth sign-in, or create individual tokens for scripts.

Screenshots use public vulnerability data and synthetic notes. Regenerate after UI changes with pnpm screenshots.

Development

Requires Node 22+, pnpm 10.17.1, Python 3, and rustup. rust-toolchain.toml pins Rust and installs the WASM target and rustfmt.

pnpm install --frozen-lockfile
pnpm build
pnpm dev

Open the local URL reported by Wrangler. The build produces dist/index.html, the self-contained offline edition, and the shared MCP WASM module. Maintained source stays readable; release builds optimize Rust/WASM and minify browser assets.

pnpm format:check
pnpm typecheck
pnpm exec playwright install --with-deps
pnpm test:all

Test runs report pass rates and emit JUnit, JSON, and browser HTML reports. GitHub Actions publishes the summary and downloadable reports even when tests fail. See Testing.

Deployment and MCP

One Cloudflare Worker with Static Assets serves the project. One KV namespace holds authentication records only; no assessment database, queues, or paid add-ons are required. Static asset requests are free; Worker calls use the account’s plan allowance. Keep the Workers Free plan for a free-first deployment. Cloudflare billing details.

Every push to main triggers build, unit/parity checks, cross-browser tests, bundle validation, deployment, and smoke checks. Pull requests run validation without deployment credentials. Production CI needs CLOUDFLARE_API_TOKEN as a repository secret and CLOUDFLARE_ACCOUNT_ID as a repository variable. See Deployment, including token permissions and rollback instructions.

Local MCP: pnpm mcp:stdio. Hosted MCP: https://quietscore.cancun.workers.dev/mcp, using GitHub sign-in with OAuth/PKCE or individual script tokens. Manage connections · Authentication setup. The browser calculator never calls this endpoint.

Documentation

• Privacy and Security policy

• Architecture, design, and interaction flows

• Testing and result publication

• MCP sign-in and token management

• Deployment and operations

• CVSS sources and sample acknowledgments

License and acknowledgments

QuietScore’s original code and documentation use BSD-2-Clause, permitting commercial use and redistribution with attribution and the license disclaimer. FIRST’s calculator data/reference code retains its BSD-2-Clause notice. Scoring definitions and guidance come from FIRST’s official materials.

Export icons are Lucide, version 1.52.0, free for personal and commercial use under the ISC license. Four SVGs are embedded locally; there is no icon CDN or font request. The retained upstream notice also covers Feather-derived icons under MIT. See third-party notices.