mcp-scorecard 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +32 -0
- package/llms.txt +13 -0
- package/package.json +5 -2
package/AGENTS.md
ADDED
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
# Agent Development Notes
|
|
2
|
+
|
|
3
|
+
## Scope
|
|
4
|
+
|
|
5
|
+
This repo is an agent-readiness scorecard for MCP servers. It launches a target over stdio, inspects the MCP contract, and emits a scored report without persisting private tool payloads.
|
|
6
|
+
|
|
7
|
+
## Commands
|
|
8
|
+
|
|
9
|
+
- Install: `npm ci`
|
|
10
|
+
- Typecheck: `npm run typecheck`
|
|
11
|
+
- Build: `npm run build`
|
|
12
|
+
- Self smoke: `npm run test:self`
|
|
13
|
+
- Full gate: `npm test`
|
|
14
|
+
- Package preview: `npm pack --dry-run`
|
|
15
|
+
|
|
16
|
+
## Rules
|
|
17
|
+
|
|
18
|
+
- Do not persist raw MCP responses from probed servers. Keep reports limited to scores, counts, labels, and redacted findings.
|
|
19
|
+
- Preserve `MCP_PROBE=1` behavior so auth-heavy MCPs can expose contracts without live credentials.
|
|
20
|
+
- New checks must be deterministic and explain the exact remediation in `fixes`.
|
|
21
|
+
- Keep the score stable enough for CI gates; avoid changing weights casually.
|
|
22
|
+
- Any new network behavior must be explicit in docs and disabled for local-path targets unless required.
|
|
23
|
+
|
|
24
|
+
## Agent-readiness checklist
|
|
25
|
+
|
|
26
|
+
Before publishing a new version:
|
|
27
|
+
|
|
28
|
+
1. `npm test`
|
|
29
|
+
2. `npm pack --dry-run`
|
|
30
|
+
3. Run the built CLI against at least one known local-first MCP package
|
|
31
|
+
4. Confirm markdown and JSON outputs both include actionable fixes
|
|
32
|
+
5. Update `CHANGELOG.md` for score or output-shape changes
|
package/llms.txt
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
# mcp-scorecard
|
|
2
|
+
Agent-readiness scorecard for MCP servers. Probes a target over stdio, runs 10 quality checks, and returns a 0-100 score with actionable fixes.
|
|
3
|
+
|
|
4
|
+
Repository: https://github.com/davidmosiah/mcp-scorecard
|
|
5
|
+
NPM: https://www.npmjs.com/package/mcp-scorecard
|
|
6
|
+
Primary command: npm exec --yes --package=mcp-scorecard -- mcp-scorecard <package-or-repo>
|
|
7
|
+
MCP command: none; this is a CLI auditor for MCP servers.
|
|
8
|
+
|
|
9
|
+
- Use `mcp-scorecard <target> --json` when another agent or CI job needs structured output.
|
|
10
|
+
- Use `mcp-scorecard <target> --min-score 80` as a release gate.
|
|
11
|
+
- The probe launches targets with `MCP_PROBE=1`; MCP authors can use that env var to expose manifests without requiring live credentials.
|
|
12
|
+
- The report is not a security audit. It checks contract shape, privacy affordances, mutation gating, resources, descriptions, annotations, and manifest discoverability.
|
|
13
|
+
- Raw probed payloads should not be persisted. Reports should contain counts, labels, and redacted findings only.
|
package/package.json
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-scorecard",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
|
+
"mcpName": "io.github.davidmosiah/mcp-scorecard",
|
|
4
5
|
"description": "Agent-readiness scorecard for any MCP server. Probes a target, runs 10 checks, outputs a 0-100 score with actionable findings.",
|
|
5
6
|
"type": "module",
|
|
6
7
|
"bin": {
|
|
@@ -10,7 +11,9 @@
|
|
|
10
11
|
"dist",
|
|
11
12
|
"README.md",
|
|
12
13
|
"LICENSE",
|
|
13
|
-
"CHANGELOG.md"
|
|
14
|
+
"CHANGELOG.md",
|
|
15
|
+
"AGENTS.md",
|
|
16
|
+
"llms.txt"
|
|
14
17
|
],
|
|
15
18
|
"scripts": {
|
|
16
19
|
"build": "tsc -p tsconfig.json",
|