@agentscore-xyz/mcp-server 2.2.0 → 2.2.1

package/README.md

@@ -1,12 +1,18 @@
 # @agentscore-xyz/mcp-server
 
-MCP security trust layer. Scan packages, get trust verdicts, inspect repo-wide MCP dependencies, generate Policy Gate setup, check incident exposure, and query the abuse database. Seven tools for MCP security decisions. No API key, zero config.
+**Ask your agent if an npm MCP package is safe to install.** A drop-in MCP server that exposes AgentScore's live security data to Claude, Cursor, ChatGPT, and any MCP-compatible client. No API key, zero config, eight tools.
 
-[![KYA Scan](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/scan?npm=@agentscore-xyz/mcp-server)
+[![AgentScore](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/report/@agentscore-xyz/mcp-server)
 
-> **Scan any MCP package for security issues:** [agentscores.xyz](https://agentscores.xyz)
+> Browse the live data: [agentscores.xyz](https://agentscores.xyz) — 1,600+ monitored MCP packages, continuously updated, public correction loop at [/scanner/precision](https://agentscores.xyz/scanner/precision).
 
-## Quick Start
+## Why it exists
+
+MCP clients install packages from npm without a security gate. Most users have no way to ask, mid-conversation, "is this package safe?" before they wire it into their agent. This server makes that question askable directly inside the same chat where you discover the package.
+
+It is the **machine-readable trust layer** behind agentscores.xyz, packaged as an MCP server so any agent can consume it.
+
+## Quick start
 
 ### Claude Desktop
 
@@ -23,59 +29,64 @@ Add to your `claude_desktop_config.json`:
 }
 ```
 
-### Cursor / Any MCP Client
+### Cursor / VS Code / any MCP client
 
 ```bash
 npx @agentscore-xyz/mcp-server
 ```
 
-## What This Does
+## What you can ask
 
-Your AI can now make security decisions about MCP packages:
+The primary use case: trust questions about packages, answered in conversation.
 
 > **You:** "Is exa-mcp-server safe to install?"
 >
 > **Claude:** *calls get_verdict* "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."
 
-> **You:** "The axios package was compromised. Which MCP servers are affected?"
->
-> **Claude:** *calls check_exposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
-
-> **You:** "Scan @azure-devops/mcp for security issues"
+> **You:** "Scan @azure-devops/mcp for security issues."
 >
 > **Claude:** *calls scan_package* "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."
 
-> **You:** "Check this repo for MCP dependencies"
+> **You:** "The axios package was compromised. Which MCP servers depend on it?"
 >
-> **Claude:** *calls check_my_repo* "MCP dependencies found: 5. Two are warnings. Run generate_policy_gate_setup to turn these checks into a CI gate."
+> **Claude:** *calls check_exposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
 
-> **You:** "Set up AgentScore Policy Gate for this repo"
+> **You:** "Is fa-mcp-sdk monitored? What is its history?"
 >
-> **Claude:** *calls generate_policy_gate_setup* "Here is the exact GitHub Actions workflow, the AGENTSCORE_KEY secret name, and the pilot link for your repo."
+> **Claude:** *calls monitor_status* "Yes, under continuous monitoring. Latest scan: HIGH risk. Republished 15+ times since the April 25 disclosure with no maintainer engagement on the open issues."
+
+The agent picks the right tool. You ask the question the way you would ask a colleague.
+
+## CI enforcement (optional, section 2)
 
-## Available Tools
+If you want the same trust data as a merge-time policy gate rather than an in-conversation question, the same MCP server can scaffold a GitHub Actions workflow for you.
 
-| Tool | What it does |
-|------|-------------|
-| `scan_package` | Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
-| `get_verdict` | Trust decision: allow, warn, or block based on scan findings. Also reports monitoring status and publisher posture. |
-| `check_my_repo` | Inspect the current repo for MCP dependencies and summarise verdicts for every package detected locally. |
-| `generate_policy_gate_setup` | Generate the exact GitHub Actions workflow and pilot handoff link needed to enforce Policy Gate in CI. |
-| `check_exposure` | Incident response: which monitored MCP servers depend on a given package? |
-| `check_abuse` | Query the KYA abuse database for reported packages or agents |
-| `monitor_status` | Check if a package is under continuous monitoring and get scan history |
+> **You:** "Check this repo for MCP dependencies and set up a policy gate."
+>
+> **Claude:** *calls check_my_repo, then install_policy_gate* "Found 5 MCP packages in your repo. Workflow written to `.github/workflows/agentscore-policy-gate.yml`. Commit, push, and the first PR will provision the gate via GitHub OIDC."
+
+Three tools support that flow:
 
-## From Ad-Hoc Scans To CI Enforcement
+- `check_my_repo` — inspect the current repo's MCP dependencies.
+- `generate_policy_gate_setup` — preview the OIDC-based GitHub Actions workflow.
+- `install_policy_gate` — write `.github/workflows/agentscore-policy-gate.yml` directly into the repo.
 
-The MCP server now bridges one-off package checks into the sticky product:
+The gate is the same data, just at a different point in the lifecycle. The primary surface is still the question.
 
-1. Run `check_my_repo` to see every MCP package used in a repo.
-2. Run `generate_policy_gate_setup` to get the exact GitHub Actions workflow.
-3. Start the free pilot to receive a repo-scoped `AGENTSCORE_KEY`.
+## Available tools
 
-That turns "is this package safe?" into "this repo now enforces MCP dependency policy on every PR."
+| Tool | Question it answers |
+|------|---------------------|
+| `scan_package` | What does the live scan of this package look like, including install scripts, source patterns, capability surface, and findings? |
+| `get_verdict` | Should I allow, warn, or block this package? |
+| `check_exposure` | Which monitored MCP servers depend on a given package? (Incident response.) |
+| `monitor_status` | Is this package under continuous monitoring? What is its scan history? |
+| `check_abuse` | Has this package been reported in the KYA abuse database? |
+| `check_my_repo` | Inspect the current repo for MCP dependencies and summarise verdicts. |
+| `generate_policy_gate_setup` | Preview the OIDC-based GitHub Actions workflow for CI enforcement. |
+| `install_policy_gate` | Write the workflow file directly into `.github/workflows/`. |
 
-## Risk Levels
+## Risk levels
 
 | Score | Risk | Meaning |
 |-------|------|---------|
@@ -85,25 +96,31 @@ That turns "is this package safe?" into "this repo now enforces MCP dependency p
 | 30-49 | HIGH | Serious issues, not recommended |
 | 0-29 | CRITICAL | Do not use |
 
-## What the Scanner Checks
+## What the scanner checks
 
 - Install scripts (postinstall/preinstall hooks with network calls or code execution)
 - Prompt injection patterns in package metadata
 - Suspicious URLs (sketchy TLDs, ngrok, raw IPs)
-- Source code patterns (command injection, unsafe eval, hardcoded secrets)
+- Source code patterns (command injection, unsafe eval, hardcoded secrets) with context-aware mitigators
 - Publisher provenance (trusted publishing, attestations)
 - Dependency count and metadata completeness
 - MCP tool definitions extracted from published source
 
-## Monitoring
+The scanner changelog and false-positive mitigator lineage are public at [agentscores.xyz/scanner/precision](https://agentscores.xyz/scanner/precision). Findings get corrected when maintainers raise valid false-positive challenges. The correction history is part of the record, not buried.
+
+## Continuous monitoring
 
-AgentScore continuously monitors hundreds of MCP packages. The `check_exposure` and `monitor_status` tools use this live dataset. When a package like axios gets compromised, you can instantly find which MCP servers are affected.
+AgentScore monitors 1,600+ MCP packages on npm. `check_exposure` and `monitor_status` query this live dataset. When a package like axios gets compromised, you can ask mid-conversation which of your MCP servers are affected.
 
 ## Links
 
-- **Website:** [agentscores.xyz](https://agentscores.xyz)
-- **API Docs:** [agentscores.xyz/docs](https://agentscores.xyz/docs)
+- **Live data:** [agentscores.xyz](https://agentscores.xyz)
+- **Per-package reports:** [agentscores.xyz/report/<package>](https://agentscores.xyz/report)
+- **Advisory feed:** [agentscores.xyz/security/advisories](https://agentscores.xyz/security/advisories) (also RSS)
+- **API docs:** [agentscores.xyz/docs](https://agentscores.xyz/docs)
 - **Methodology:** [agentscores.xyz/methodology](https://agentscores.xyz/methodology)
+- **Scanner precision changelog:** [agentscores.xyz/scanner/precision](https://agentscores.xyz/scanner/precision)
+- **Embed a badge:** [agentscores.xyz/badge](https://agentscores.xyz/badge)
 
 ## Licence
 

package/dist/api.js

@@ -1,5 +1,6 @@
 const BASE_URL = "https://www.agentscores.xyz";
 const TIMEOUT_MS = 8000;
+const CLIENT_ID = "@agentscore-xyz/mcp-server/2.2.1";
 export class ApiError extends Error {
     status;
     code;
@@ -22,7 +23,10 @@ export async function fetchApi(path, params = {}) {
     try {
         const res = await fetch(url.toString(), {
             signal: controller.signal,
-            headers: { Accept: "application/json" },
+            headers: {
+                Accept: "application/json",
+                "X-AgentScore-Client": CLIENT_ID,
+            },
             redirect: "follow",
         });
         clearTimeout(timer);

package/dist/index.js

@@ -26,7 +26,7 @@ server.tool("monitor_status", "Check if an MCP package is under continuous monit
 server.tool("check_my_repo", "Inspect the current repo for MCP dependencies, look up AgentScore verdicts for each package, and summarise what should be gated in CI. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
 }, async (args) => handleTool("check_my_repo", args));
-server.tool("generate_policy_gate_setup", "Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the YAML, secret name, and pilot link needed for setup.", {
+server.tool("generate_policy_gate_setup", "Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the OIDC-based YAML needed for setup. No API key or secret is required.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
     repo_url: z.string().optional().describe("Optional repository URL override for the pilot handoff link."),
 }, async (args) => handleTool("generate_policy_gate_setup", args));

package/dist/tools.js

@@ -36,7 +36,8 @@ function policyGateHint(options) {
         "",
         "Policy Gate:",
         "  Run check_my_repo to inspect every MCP dependency used by this repo.",
-        "  Run generate_policy_gate_setup to turn the same checks into a CI gate.",
+        "  Run generate_policy_gate_setup to preview the CI workflow.",
+        "  Run install_policy_gate to write the workflow file directly into the repo.",
     ];
     if (options.repoUrl) {
         lines.push(`  Start a free pilot: ${buildIntentUrl("pilot", options.repoUrl)}`);
@@ -223,7 +224,7 @@ function formatRepoSummary(repoPath, repoUrl, checkedFiles, results) {
         const reasons = item.reasons.length > 0 ? ` | reasons: ${item.reasons.join(", ")}` : "";
         lines.push(`  ${item.name}@${version} - ${item.verdict.toUpperCase()} (${score}/100, ${risk}) [source: ${item.source}]${reasons}`);
     }
-    lines.push("", "Next step:", "  Run generate_policy_gate_setup to get the exact GitHub Actions workflow for this repo.", `  Start a free pilot: ${buildIntentUrl("pilot", repoUrl)}`);
+    lines.push("", "Next step:", "  Run generate_policy_gate_setup to preview the OIDC-based GitHub Actions workflow for this repo.", "  Run install_policy_gate to write .github/workflows/agentscore-policy-gate.yml directly.");
     return lines.join("\n");
 }
 function buildOidcWorkflowYaml(packages) {
@@ -254,33 +255,8 @@ function buildOidcWorkflowYaml(packages) {
     lines.push("");
     return lines.join("\n");
 }
-function buildWorkflowYaml(packages) {
-    const lines = [
-        "name: AgentScore Policy Gate",
-        "",
-        "on:",
-        "  pull_request:",
-        "  push:",
-        "    branches: [main]",
-        "",
-        "jobs:",
-        "  mcp-policy:",
-        "    runs-on: ubuntu-latest",
-        "    steps:",
-        "      - uses: actions/checkout@v4",
-        "      - uses: Thezenmonster/mcp-verdict-action@v1",
-        "        with:",
-        "          api-key: ${{ secrets.AGENTSCORE_KEY }}",
-        '          fail-open: "false"',
-    ];
-    if (packages.length > 0) {
-        lines.push(`          packages: "${packages.join(",")}"`);
-    }
-    return lines.join("\n");
-}
 function formatPolicyGateSetup(repoPath, repoUrl, dependencies, checkedFiles) {
     const explicitPackages = dependencies.map((dep) => dep.name);
-    const pilotUrl = buildIntentUrl("pilot", repoUrl);
     const lines = [
         `Repo path: ${repoPath}`,
         `Repository: ${repoUrl || "not detected"}`,
@@ -288,17 +264,17 @@ function formatPolicyGateSetup(repoPath, repoUrl, dependencies, checkedFiles) {
         `Detected MCP dependencies: ${explicitPackages.length > 0 ? explicitPackages.join(", ") : "none"}`,
         "",
         "Next steps:",
-        `1. Start a free Policy Gate pilot to get a repo-scoped key: ${pilotUrl}`,
-        "2. Add a GitHub Actions secret named AGENTSCORE_KEY to the repo.",
-        "3. Save this workflow as .github/workflows/agentscore-policy-gate.yml:",
+        "1. Save this workflow as .github/workflows/agentscore-policy-gate.yml.",
+        "2. Commit and push. The first run will authenticate with GitHub OIDC and auto-provision the repo.",
+        "3. If you want the MCP server to write the file for you, run install_policy_gate.",
         "",
-        buildWorkflowYaml(explicitPackages),
+        buildOidcWorkflowYaml(explicitPackages),
     ];
     if (explicitPackages.length === 0) {
         lines.push("", "Note:", "  No MCP packages were detected locally. The Action can still auto-detect root package.json dependencies,", "  but if this repo uses MCP packages via config files only, add them explicitly to the packages input.");
     }
     else {
-        lines.push("", "Why this workflow uses an explicit package list:", "  It keeps CI aligned with the MCP dependencies detected in this repo, even when they come from config files", "  and not just the root package.json.");
+        lines.push("", "Why this workflow uses OIDC:", "  GitHub Actions proves repo identity directly to AgentScore on each run.", "  No API key, no secret distribution, and no manual provisioning step are required.", "", "Why this workflow uses an explicit package list:", "  It keeps CI aligned with the MCP dependencies detected in this repo, even when they come from config files", "  and not just the root package.json.");
     }
     return lines.join("\n");
 }
@@ -380,9 +356,10 @@ export async function handleTool(name, args) {
                     "  1. Review the workflow file",
                     "  2. Commit and push",
                     "  3. The gate runs automatically on every PR and push to main",
-                    "",
-                    `If you want a managed pilot with custom thresholds and exceptions: ${pilotUrl}`,
                 ];
+                if (pilotUrl) {
+                    lines.push("", `If you want a managed pilot with custom thresholds and exceptions: ${pilotUrl}`);
+                }
                 return text(lines.join("\n"));
             }
             default:

package/package.json

@@ -1,60 +1,61 @@
-{
-  "name": "@agentscore-xyz/mcp-server",
-  "version": "2.2.0",
-  "mcpName": "io.github.Thezenmonster/agentscore",
-  "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, check exposure, and query abuse data.",
-  "type": "module",
-  "bin": {
-    "agentscore-mcp": "./dist/index.js"
-  },
-  "main": "./dist/index.js",
-  "scripts": {
-    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^3.22.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.4.0"
-  },
-  "keywords": [
-    "mcp",
-    "mcp-server",
-    "mcp-security",
-    "agentscore",
-    "kya",
-    "know-your-agent",
-    "trust",
-    "ai-agents",
-    "ai-security",
-    "reputation",
-    "verification",
-    "agent-trust",
-    "agent-verification",
-    "model-context-protocol",
-    "security",
-    "scanner",
-    "abuse-detection"
-  ],
-  "author": "AgentScore <hello@agentscores.xyz>",
-  "license": "MIT",
-  "homepage": "https://agentscores.xyz",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/Thezenmonster/agentscore-mcp-server"
-  },
-  "files": [
-    "dist/",
-    "README.md",
-    "smithery.yaml"
-  ],
-  "engines": {
-    "node": ">=18"
-  }
-}
+{
+  "name": "@agentscore-xyz/mcp-server",
+  "version": "2.2.1",
+  "mcpName": "io.github.Thezenmonster/agentscore",
+  "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, install the workflow directly, check exposure, and query abuse data.",
+  "type": "module",
+  "bin": {
+    "agentscore-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "scripts": {
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^3.22.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "mcp-security",
+    "agentscore",
+    "kya",
+    "know-your-agent",
+    "trust",
+    "ai-agents",
+    "ai-security",
+    "reputation",
+    "verification",
+    "agent-trust",
+    "agent-verification",
+    "model-context-protocol",
+    "security",
+    "scanner",
+    "abuse-detection"
+  ],
+  "author": "AgentScore <hello@agentscores.xyz>",
+  "license": "MIT",
+  "homepage": "https://agentscores.xyz",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Thezenmonster/agentscores.git",
+    "directory": "packages/mcp-server"
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "smithery.yaml"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}

package/smithery.yaml

@@ -1,11 +1,11 @@
-startCommand:
-  type: stdio
-  configSchema:
-    type: object
-    properties: {}
-    required: []
-  commandFunction: |-
-    (config) => ({
-      command: "npx",
-      args: ["-y", "@agentscore-xyz/mcp-server"]
-    })
+startCommand:
+  type: stdio
+  configSchema:
+    type: object
+    properties: {}
+    required: []
+  commandFunction: |-
+    (config) => ({
+      command: "npx",
+      args: ["-y", "@agentscore-xyz/mcp-server"]
+    })