mcp-scorecard 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +7 -0
- package/dist/constants.d.ts +1 -1
- package/dist/constants.js +1 -1
- package/dist/mcp-server.js +49 -2
- package/dist/mcp-server.js.map +1 -1
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.5.0
|
|
4
|
+
|
|
5
|
+
- **The `audit` MCP tool now ships agent-expanding metadata** (dogfooding our own checks):
|
|
6
|
+
- **Tool annotations** — `readOnlyHint: true`, `idempotentHint: true`, `openWorldHint: true` (it inspects/fetches remote packages but never mutates your environment), so agents can safely auto-run it to vet a server before installing.
|
|
7
|
+
- **`outputSchema` + `structuredContent`** — the audit result is now declared and returned as a typed object (mirrors `AuditReport`: `totalScore`, `grade`, `mode`, `checks[]`, …), enabling reliable grade-gating (e.g. "only install if grade is A/B") without string-scraping.
|
|
8
|
+
- Synced `server.json` version to the package version (was drifted at 0.1.3).
|
|
9
|
+
|
|
3
10
|
## 0.4.0
|
|
4
11
|
|
|
5
12
|
- **Compare** (`mcp-scorecard compare a b c`): audit several targets, print a ranked side-by-side table.
|
package/dist/constants.d.ts
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* same string. Bumping this without updating package.json is intentional during
|
|
4
4
|
* dev (keep src as source of truth); a release script can sync them.
|
|
5
5
|
*/
|
|
6
|
-
export declare const SERVER_VERSION = "0.
|
|
6
|
+
export declare const SERVER_VERSION = "0.5.0";
|
|
7
7
|
/** Identifier used when the probe connects to a target MCP server. */
|
|
8
8
|
export declare const PROBE_CLIENT_NAME = "mcp-scorecard";
|
|
9
9
|
/** Env var set on the spawned target so MCP authors can detect we are probing
|
package/dist/constants.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* same string. Bumping this without updating package.json is intentional during
|
|
4
4
|
* dev (keep src as source of truth); a release script can sync them.
|
|
5
5
|
*/
|
|
6
|
-
export const SERVER_VERSION = '0.
|
|
6
|
+
export const SERVER_VERSION = '0.5.0';
|
|
7
7
|
/** Identifier used when the probe connects to a target MCP server. */
|
|
8
8
|
export const PROBE_CLIENT_NAME = 'mcp-scorecard';
|
|
9
9
|
/** Env var set on the spawned target so MCP authors can detect we are probing
|
package/dist/mcp-server.js
CHANGED
|
@@ -17,6 +17,48 @@ import { runWebAudit } from './audit/web/web-runner.js';
|
|
|
17
17
|
import { resolveGithubRepo } from './resolvers/github-resolver.js';
|
|
18
18
|
import { resolveLocal } from './resolvers/local-resolver.js';
|
|
19
19
|
import { resolveNpmPackage } from './resolvers/npm-resolver.js';
|
|
20
|
+
/**
|
|
21
|
+
* JSON Schema for the audit tool's structured output (mirrors AuditReport).
|
|
22
|
+
* Declared as a plain object to stay decoupled from the SDK's zod version.
|
|
23
|
+
* Lets agents grade-gate reliably (e.g. only install if grade <= "B").
|
|
24
|
+
*/
|
|
25
|
+
const AUDIT_OUTPUT_SCHEMA = {
|
|
26
|
+
type: 'object',
|
|
27
|
+
properties: {
|
|
28
|
+
target: {
|
|
29
|
+
type: 'object',
|
|
30
|
+
properties: {
|
|
31
|
+
displayName: { type: 'string' },
|
|
32
|
+
version: { type: 'string' },
|
|
33
|
+
serverName: { type: 'string' },
|
|
34
|
+
serverVersion: { type: 'string' }
|
|
35
|
+
},
|
|
36
|
+
required: ['displayName']
|
|
37
|
+
},
|
|
38
|
+
totalScore: { type: 'number', description: '0–100 agent-readiness + security score' },
|
|
39
|
+
grade: { type: 'string', enum: ['A', 'B', 'C', 'D', 'F'] },
|
|
40
|
+
mode: { type: 'string', enum: ['stdio', 'web'] },
|
|
41
|
+
checks: {
|
|
42
|
+
type: 'array',
|
|
43
|
+
items: {
|
|
44
|
+
type: 'object',
|
|
45
|
+
properties: {
|
|
46
|
+
id: { type: 'string' },
|
|
47
|
+
label: { type: 'string' },
|
|
48
|
+
score: { type: 'number' },
|
|
49
|
+
status: { type: 'string', enum: ['pass', 'warn', 'fail'] },
|
|
50
|
+
summary: { type: 'string' },
|
|
51
|
+
details: { type: 'array', items: { type: 'string' } },
|
|
52
|
+
fixes: { type: 'array', items: { type: 'string' } }
|
|
53
|
+
},
|
|
54
|
+
required: ['id', 'label', 'score', 'status']
|
|
55
|
+
}
|
|
56
|
+
},
|
|
57
|
+
generatedAt: { type: 'string' },
|
|
58
|
+
scorecardVersion: { type: 'string' }
|
|
59
|
+
},
|
|
60
|
+
required: ['target', 'totalScore', 'grade', 'mode', 'checks', 'generatedAt', 'scorecardVersion']
|
|
61
|
+
};
|
|
20
62
|
async function auditTarget(target) {
|
|
21
63
|
if (/^https?:\/\//.test(target) && !/github\.com/.test(target)) {
|
|
22
64
|
return runWebAudit(target);
|
|
@@ -49,7 +91,9 @@ export async function serve() {
|
|
|
49
91
|
}
|
|
50
92
|
},
|
|
51
93
|
required: ['target']
|
|
52
|
-
}
|
|
94
|
+
},
|
|
95
|
+
annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
|
|
96
|
+
outputSchema: AUDIT_OUTPUT_SCHEMA
|
|
53
97
|
}
|
|
54
98
|
]
|
|
55
99
|
}));
|
|
@@ -64,7 +108,10 @@ export async function serve() {
|
|
|
64
108
|
try {
|
|
65
109
|
const report = await auditTarget(target);
|
|
66
110
|
const summary = `${report.target.displayName}: ${report.totalScore}/100 (grade ${report.grade}, ${report.mode} mode)`;
|
|
67
|
-
return {
|
|
111
|
+
return {
|
|
112
|
+
content: [{ type: 'text', text: `${summary}\n\n${JSON.stringify(report, null, 2)}` }],
|
|
113
|
+
structuredContent: report
|
|
114
|
+
};
|
|
68
115
|
}
|
|
69
116
|
catch (err) {
|
|
70
117
|
return {
|
package/dist/mcp-server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,KAAK,UAAU,WAAW,CAAC,MAAc;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EACT,0SAA0S;gBAC5S,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yEAAyE;yBACvF;qBACF;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;
|
|
1
|
+
{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;GAIG;AACH,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAClC;YACD,QAAQ,EAAE,CAAC,aAAa,CAAC;SAC1B;QACD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE;QACrF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;QAChD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;oBAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACrD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACpD;gBACD,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;aAC7C;SACF;QACD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACrC;IACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC;CACjG,CAAC;AAEF,KAAK,UAAU,WAAW,CAAC,MAAc;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EACT,0SAA0S;gBAC5S,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yEAAyE;yBACvF;qBACF;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;gBAC9E,YAAY,EAAE,mBAAmB;aAClC;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAE,GAAG,CAAC,MAAM,CAAC,SAAiD,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1G,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC;YACtH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;gBACrF,iBAAiB,EAAE,MAA4C;aAChE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,MAAM,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACtH,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,6BAA6B,cAAc,gCAAgC,CAAC,CAAC;AAC7F,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-scorecard",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"mcpName": "io.github.davidmosiah/mcp-scorecard",
|
|
5
|
-
"description": "Grade any MCP server's agent-readiness in one command
|
|
5
|
+
"description": "Grade any MCP server's agent-readiness in one command — stdio (10 protocol checks) AND hosted/remote servers (10 security + web agent-readiness checks). Open source, local-first, no credentials.",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"bin": {
|
|
8
8
|
"mcp-scorecard": "dist/index.js"
|
|
@@ -64,4 +64,4 @@
|
|
|
64
64
|
"access": "public"
|
|
65
65
|
},
|
|
66
66
|
"main": "dist/index.js"
|
|
67
|
-
}
|
|
67
|
+
}
|