mcp-scorecard 0.1.1__tar.gz

mcp_scorecard-0.1.1/.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/mcp-scorecard
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: Verify package metadata
+        run: twine check dist/*
+
+      - name: Publish to PyPI (Trusted Publisher OIDC)
+        uses: pypa/gh-action-pypi-publish@release/v1

mcp_scorecard-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: Verify package metadata
+        run: twine check dist/*
+
+      - name: Upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${GITHUB_REF##*/}" dist/* --clobber
+
+      # PyPI publishing is handled by publish.yml (Trusted Publisher / OIDC).
+      # This workflow only uploads the sdist + wheel to the GitHub Release.

mcp_scorecard-0.1.1/.github/workflows/test.yml

@@ -0,0 +1,22 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: pip install -e ".[dev,mcp]"
+      - run: pytest -q
+      - run: ruff check .

mcp_scorecard-0.1.1/.gitignore

@@ -0,0 +1,14 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.venv/
+venv/
+.DS_Store
+*.swp

mcp_scorecard-0.1.1/CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog
+
+All notable changes to `mcp-scorecard` will be documented in this file.
+The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.1.1] — 2026-07-13
+
+### Changed
+- Renamed from `mcp-preflight` to `mcp-scorecard` before first PyPI upload
+  (an unrelated `mcp-preflight` project already occupies that PyPI namespace,
+  and `mcp-pre-flight` was also rejected as too similar). Package, CLI, MCP
+  server, and repository are all `mcp-scorecard` from v0.1.1. v0.1.0 exists
+  only as a pre-rename local tag and was never published.
+
+## [0.1.0] — 2026-07-13 (unpublished)
+
+### Added
+- Four-layer scorecard model: Passive Footprint / Use-Case Scoping / Security / Name Safety.
+- AST loader for FastMCP-style Python servers (`@mcp.tool()` extraction, no code execution).
+- Manifest loader for non-Python MCP servers (`tools/list` JSON).
+- Layer A — passive footprint: `initial_token_load` (tiktoken cl100k), `per_tool_tokens`,
+  bloat detection (> 150 tok description), schema verbosity, tool count thresholds.
+- Layer B — use-case scoping: when-to-use trigger detection, vague-verb scan,
+  overlap detection, naming-style consistency, AI-slop markers.
+- Layer C — security: prompt-injection-in-description, tool-shadowing, hardcoded
+  secret regex sweep (AWS / GitHub / OpenAI / Anthropic / Slack / PEM).
+- Layer D — name safety: case collision, Levenshtein brand similarity,
+  separator variants, namespace hygiene. Bundled ~50 brands + known MCPs.
+- CLI: `mcp-scorecard` / `mpf` with `scan`, `footprint`, `scoping`, `security`, `name`.
+- MCP server: `mcp-scorecard-mcp` exposes five preflight_* tools over stdio.
+- Dogfood/validation on domain-pre-flight, rag-db-advisor, opencut-mcp, and self.
+- CI: pytest on 3.10 / 3.11 / 3.12, ruff.
+- TypeScript static manifest extractor: `scripts/extract_ts_manifest.py`.

mcp_scorecard-0.1.1/CODE_OF_CONDUCT.md

@@ -0,0 +1,23 @@
+# Code of Conduct
+
+## Standards
+
+Be respectful and constructive. Specifically:
+
+- Engage with the substance of contributions, not the contributor.
+- Surface disagreements as questions or trade-offs, not personal critique.
+- If you encounter behaviour that makes the project less welcoming to a class of people, raise it (privately if you prefer) so we can address it.
+
+## Scope
+
+This applies to all project spaces: GitHub issues / PRs / discussions, the project README and docs, and any out-of-band communication that references the project.
+
+## Reporting
+
+Open a private security advisory or contact the maintainer directly via the GitHub profile linked from the README. Reports are confidential.
+
+## Enforcement
+
+The maintainer reserves the right to remove comments, close issues, or block accounts that repeatedly violate the standards above. Persistent or egregious violations may result in a permanent ban.
+
+This document is intentionally short. The Contributor Covenant (https://www.contributor-covenant.org/) is the underlying inspiration; if you want a longer reference text, read it there.

mcp_scorecard-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ken Imoto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mcp_scorecard-0.1.1/PKG-INFO

@@ -0,0 +1,129 @@
+Metadata-Version: 2.4
+Name: mcp-scorecard
+Version: 0.1.1
+Summary: Pre-flight checks for MCP servers: passive token footprint, use-case scoping, security, and name safety. LLM-facing quality scorecard.
+Project-URL: Homepage, https://github.com/kenimo49/mcp-scorecard
+Project-URL: Repository, https://github.com/kenimo49/mcp-scorecard
+Project-URL: Issues, https://github.com/kenimo49/mcp-scorecard/issues
+Project-URL: Funding, https://github.com/sponsors/kenimo49
+Author: Ken Imoto
+License: MIT
+License-File: LICENSE
+Keywords: audit,llm,mcp,model-context-protocol,pre-flight,security,token
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1
+Requires-Dist: levenshtein>=0.25
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.7
+Requires-Dist: tiktoken>=0.7
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0; extra == 'dev'
+Requires-Dist: pytest-mock>=3.12; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# mcp-scorecard
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![GitHub Sponsors](https://img.shields.io/github/sponsors/kenimo49?logo=githubsponsors&label=Sponsor)](https://github.com/sponsors/kenimo49)
+[![Ko-fi](https://img.shields.io/badge/Ko--fi-tip-FF5E5B?logo=kofi&logoColor=white)](https://ko-fi.com/kenimo49)
+
+> ⚠️ **Status: v0.1 alpha — under active development.**
+> Rules, thresholds, and scoring are being calibrated against real-world MCP servers.
+
+Pre-flight checks for MCP (Model Context Protocol) servers.
+
+`mcp-scorecard` answers one question: **"Is this MCP server safe and efficient enough for LLMs to actually use?"** — before you publish it, install it, or let it into your agent config.
+
+Existing MCP tools cover runtime security (MCP-Scan) and protocol compliance (MCP Inspector). This one covers the missing layer: **how expensive is the server just to keep registered, and are its tools scoped well enough for an LLM to pick the right one?**
+
+Companion tool to the book **『MCP実践セキュリティ』** (Impress NextPublishing).
+
+## The four layers
+
+| Layer | What it measures | Status |
+|-------|------------------|--------|
+| **A. Passive Footprint** | Tokens the server steals from every LLM turn just by being listed. `tools/list` initial load, per-tool cost, bloat ratio, schema verbosity | v0.1 |
+| **B. Use-Case Scoping** | Whether each tool is narrow enough that the LLM knows when to use it. When-to-use present, vague verb scan, overlap detection, naming consistency, AI Slop | v0.1 |
+| **C. Security** | Own rules (prompt injection in description, tool shadowing, hardcoded secrets, transport hygiene) + optional MCP-Scan wrap | v0.1 own rules; wrap in v0.2 |
+| **D. Name Safety** | Case collision, brand similarity, separator variants, namespace hygiene | v0.1 |
+
+Design details: [docs/design.md](docs/design.md).
+
+## Install
+
+```bash
+pip install mcp-scorecard              # CLI + library
+pip install "mcp-scorecard[mcp]"       # + MCP server (stdio)
+```
+
+## Use as a CLI
+
+```bash
+# Full scan
+mcp-scorecard scan ./path/to/server.py
+mcp-scorecard scan http://localhost:8000/
+mcp-scorecard scan pypi:some-mcp
+
+# Layer-only
+mcp-scorecard footprint ./server.py
+mcp-scorecard scoping ./server.py
+mcp-scorecard security ./server.py
+mcp-scorecard name my-new-mcp
+
+# CI-friendly
+mcp-scorecard scan ./server.py --json
+mcp-scorecard scan ./server.py --format sarif
+# exit codes: 0=GREEN/YELLOW, 1=ORANGE, 2=RED
+```
+
+## Use as an MCP server (self-hosting)
+
+Register `mcp-scorecard` itself as an MCP tool in Claude Code / Cursor / Windsurf, then ask the LLM to audit another MCP:
+
+```json
+{
+  "mcpServers": {
+    "mcp-scorecard": {
+      "command": "mcp-scorecard-mcp"
+    }
+  }
+}
+```
+
+Then in chat: *"score the MCP server at ./my-server.py"*.
+
+## Why passive footprint matters
+
+Every tool description and inputSchema in a registered MCP server is sent to the LLM on every turn — because the model needs to see them to decide which tool to call. A single verbose server can silently burn 5,000+ tokens per turn before anyone touches it.
+
+`mcp-scorecard footprint` measures exactly that, so you can trim before you publish.
+
+## Roadmap
+
+- **v0.1** — Layers A + B + D full, Layer C own rules, CLI + MCP server
+- **v0.2** — MCP-Scan wrap, SARIF, real MCP client negotiation
+- **v0.3** — Book『MCP実践セキュリティ』章別ルール取り込み
+- **v0.4** — Registry-source targets (`github:` / `npm:`)
+
+## Support this project
+
+- 💚 [GitHub Sponsors](https://github.com/sponsors/kenimo49)
+- ☕ [Ko-fi](https://ko-fi.com/kenimo49)
+
+## License
+
+MIT.

mcp_scorecard-0.1.1/README.md

@@ -0,0 +1,92 @@
+# mcp-scorecard
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![GitHub Sponsors](https://img.shields.io/github/sponsors/kenimo49?logo=githubsponsors&label=Sponsor)](https://github.com/sponsors/kenimo49)
+[![Ko-fi](https://img.shields.io/badge/Ko--fi-tip-FF5E5B?logo=kofi&logoColor=white)](https://ko-fi.com/kenimo49)
+
+> ⚠️ **Status: v0.1 alpha — under active development.**
+> Rules, thresholds, and scoring are being calibrated against real-world MCP servers.
+
+Pre-flight checks for MCP (Model Context Protocol) servers.
+
+`mcp-scorecard` answers one question: **"Is this MCP server safe and efficient enough for LLMs to actually use?"** — before you publish it, install it, or let it into your agent config.
+
+Existing MCP tools cover runtime security (MCP-Scan) and protocol compliance (MCP Inspector). This one covers the missing layer: **how expensive is the server just to keep registered, and are its tools scoped well enough for an LLM to pick the right one?**
+
+Companion tool to the book **『MCP実践セキュリティ』** (Impress NextPublishing).
+
+## The four layers
+
+| Layer | What it measures | Status |
+|-------|------------------|--------|
+| **A. Passive Footprint** | Tokens the server steals from every LLM turn just by being listed. `tools/list` initial load, per-tool cost, bloat ratio, schema verbosity | v0.1 |
+| **B. Use-Case Scoping** | Whether each tool is narrow enough that the LLM knows when to use it. When-to-use present, vague verb scan, overlap detection, naming consistency, AI Slop | v0.1 |
+| **C. Security** | Own rules (prompt injection in description, tool shadowing, hardcoded secrets, transport hygiene) + optional MCP-Scan wrap | v0.1 own rules; wrap in v0.2 |
+| **D. Name Safety** | Case collision, brand similarity, separator variants, namespace hygiene | v0.1 |
+
+Design details: [docs/design.md](docs/design.md).
+
+## Install
+
+```bash
+pip install mcp-scorecard              # CLI + library
+pip install "mcp-scorecard[mcp]"       # + MCP server (stdio)
+```
+
+## Use as a CLI
+
+```bash
+# Full scan
+mcp-scorecard scan ./path/to/server.py
+mcp-scorecard scan http://localhost:8000/
+mcp-scorecard scan pypi:some-mcp
+
+# Layer-only
+mcp-scorecard footprint ./server.py
+mcp-scorecard scoping ./server.py
+mcp-scorecard security ./server.py
+mcp-scorecard name my-new-mcp
+
+# CI-friendly
+mcp-scorecard scan ./server.py --json
+mcp-scorecard scan ./server.py --format sarif
+# exit codes: 0=GREEN/YELLOW, 1=ORANGE, 2=RED
+```
+
+## Use as an MCP server (self-hosting)
+
+Register `mcp-scorecard` itself as an MCP tool in Claude Code / Cursor / Windsurf, then ask the LLM to audit another MCP:
+
+```json
+{
+  "mcpServers": {
+    "mcp-scorecard": {
+      "command": "mcp-scorecard-mcp"
+    }
+  }
+}
+```
+
+Then in chat: *"score the MCP server at ./my-server.py"*.
+
+## Why passive footprint matters
+
+Every tool description and inputSchema in a registered MCP server is sent to the LLM on every turn — because the model needs to see them to decide which tool to call. A single verbose server can silently burn 5,000+ tokens per turn before anyone touches it.
+
+`mcp-scorecard footprint` measures exactly that, so you can trim before you publish.
+
+## Roadmap
+
+- **v0.1** — Layers A + B + D full, Layer C own rules, CLI + MCP server
+- **v0.2** — MCP-Scan wrap, SARIF, real MCP client negotiation
+- **v0.3** — Book『MCP実践セキュリティ』章別ルール取り込み
+- **v0.4** — Registry-source targets (`github:` / `npm:`)
+
+## Support this project
+
+- 💚 [GitHub Sponsors](https://github.com/sponsors/kenimo49)
+- ☕ [Ko-fi](https://ko-fi.com/kenimo49)
+
+## License
+
+MIT.

mcp_scorecard-0.1.1/SECURITY.md

@@ -0,0 +1,26 @@
+# Security policy
+
+## Supported versions
+
+The latest minor (`0.x`) is supported. Older releases receive no fixes.
+
+## Reporting a vulnerability
+
+`domain-pre-flight` is a defensive / pre-flight tool; it does not handle credentials, run servers, or process untrusted input at scale. The realistic vulnerability surfaces are:
+
+1. The HTTP clients in `handles.py` / `rdap.py` (a malicious response could trigger excessive memory / CPU).
+2. The DNS client in `dns_sanity.py` (a malicious authoritative server could attempt DoS via large TXT records).
+3. The data-loading paths for `data/known_brands.txt` and `data/negative_meanings/*.txt` (a tampered repo could ship a poisoned word list).
+
+To report a suspected vulnerability:
+
+- Open a **private security advisory** at https://github.com/kenimo49/domain-pre-flight/security/advisories/new.
+- Or email the maintainer directly (contact via the GitHub profile).
+
+Please do **not** file a public issue for a suspected vulnerability.
+
+## What to expect
+
+- Acknowledgement within 5 working days.
+- A patch or detailed mitigation guidance within 30 days for confirmed issues.
+- Public disclosure only after the fix is released; CVE assignment if applicable.

mcp_scorecard-0.1.1/docs/design.md

@@ -0,0 +1,138 @@
+# mcp-scorecard — design doc
+
+> Pre-flight checks for MCP servers. Answers **"is this MCP server safe and efficient enough for LLMs to use?"** before you publish or install it.
+
+## Positioning
+
+Existing tools focus on runtime security (MCP-Scan / Cisco MCP-Scanner / AgentAuditKit) or protocol compliance (MCP Inspector / mcp-validator / mcp-validation). None cover the **LLM-facing quality** dimension: how much context the server consumes just by being listed, whether its tools have well-scoped use cases, and whether description prose is clear.
+
+`mcp-scorecard` is the pre-publish scorecard that closes that gap, then wraps the security tools underneath so a single command grades your MCP end-to-end.
+
+Companion to the book **『MCP実践セキュリティ』** — the book teaches the checks, this tool runs them.
+
+## Four layers
+
+### Layer A — Passive Footprint (differentiator, unique to this tool)
+
+The tokens an MCP server steals from every LLM turn **just by being registered**, regardless of whether tools are called.
+
+| Check | What it measures |
+|-------|------------------|
+| `initial_token_load` | Total tiktoken (cl100k) for the tools/list response: every tool name + description + inputSchema |
+| `per_tool_tokens` | Token cost per tool, ranked highest → lowest |
+| `bloat_ratio` | Fraction of tools whose description exceeds 150 tokens |
+| `tool_count` | Total tool count. Warn > 15, fail > 30 |
+| `schema_verbosity` | inputSchema tokens vs description tokens — schema-heavy tools are a common LLM budget sink |
+
+Verdict bands: GREEN < 1,500 tokens · YELLOW 1,500–4,000 · ORANGE 4,000–8,000 · RED > 8,000 (numbers calibrated against real-world MCP servers, revised as we collect more data).
+
+### Layer B — Use-Case Scoping (differentiator)
+
+Whether each tool is narrow enough that the LLM knows when to reach for it. Broad "do-anything" tools inflate footprint and cause tool-selection errors.
+
+| Check | Detects |
+|-------|---------|
+| `when_to_use_present` | Does the description state a trigger condition? (e.g. "Use this when …") |
+| `vague_verb_scan` | `handle`, `process`, `manage`, `deal with`, `work with`, `execute` without qualifier |
+| `overlap_detection` | Semantic near-duplicates between tools (same responsibility, different names) |
+| `naming_consistency` | Mixed snake_case / camelCase / kebab-case across tools |
+| `description_style` | AI Slop patterns (bullet-list-of-adjectives, marketing prose) — piggy-backs on avoid-ai-writing-en heuristics |
+| `input_output_coherence` | Does the description promise what the schema returns? |
+
+### Layer C — Security (borrow from existing tools + own rules)
+
+Mostly borrowed. `mcp-scorecard security` shells out to MCP-Scan if installed and normalises the result, and adds a small independent ruleset for defence in depth.
+
+Own rules:
+- `prompt_injection_in_description` — imperative phrases aimed at the LLM inside tool descriptions ("ignore previous instructions", "always call …")
+- `tool_shadowing` — names that impersonate common system utilities (`ls`, `read_file`, `execute`) without a namespace
+- `hardcoded_secret_pattern` — regex sweep on the server source if `--source-path` given
+- `transport_hygiene` — CORS, OAuth 2.1 presence for HTTP transports, DNS-rebinding headers
+- `protocol_version` — reports negotiated MCP spec version, warns if pre-2025-06-18
+
+External rules (via wrap):
+- MCP-Scan / agent-scan detections (E001 prompt injection, E002 tool shadowing, W007/W008 credentials, W011 untrusted content, toxic flows)
+- Optional: mcp-validation / mcp-validator for protocol compliance
+
+### Layer D — Name Safety
+
+Before publishing an MCP server, is the name safe from typosquat suspicion?
+
+| Check | Method |
+|-------|--------|
+| `case_collision` | Same name in different casing already registered somewhere obvious (npm / PyPI / MCP.so) |
+| `brand_similarity` | Levenshtein ≤ 2 to a bundled list of well-known brands / official MCP servers |
+| `separator_variants` | `mcp-scan` vs `mcpscan` vs `mcp_scan` — flag if a common one is taken |
+| `namespace_hygiene` | Recommend `@vendor/tool` style for scoped names |
+
+Bundled list starts small (~50 obvious brands + known official MCPs) and grows via `scripts/refresh_known_brands.py`.
+
+## Aggregate scorecard
+
+A-F grade per layer, plus overall. JSON / Markdown / SARIF output. CI-friendly exit codes:
+- `0` — GREEN / YELLOW
+- `1` — ORANGE
+- `2` — RED
+
+```
+Layer A (Footprint):     B  (2,340 tokens across 8 tools)
+Layer B (Use-case):      C  (3 tools missing when-to-use)
+Layer C (Security):      A  (no findings; MCP-Scan clean)
+Layer D (Name safety):   A  (no collisions)
+-----------------------------------------
+Overall:                 B
+```
+
+## CLI shape
+
+```
+mcp-scorecard scan <target>              # all layers
+mcp-scorecard footprint <target>         # Layer A only
+mcp-scorecard scoping <target>           # Layer B only
+mcp-scorecard security <target>          # Layer C only
+mcp-scorecard name <name>                # Layer D only
+
+# targets:
+#   ./path/to/server.py       — Python entry (stdio, subprocess launch)
+#   http://localhost:8000/    — HTTP transport
+#   pypi:some-mcp             — install and scan
+#   npm:@scope/some-mcp       — install and scan
+#   github:owner/repo         — clone and scan
+```
+
+## MCP server surface (self-hosting / dogfooding)
+
+Exposes the same layers as MCP tools so an LLM can audit an MCP server from a chat:
+
+```
+preflight_scan(target, layers?)
+preflight_footprint(target)
+preflight_scoping(target)
+preflight_security(target)
+preflight_name_check(name)
+```
+
+Runs via `mcp-scorecard-mcp` (stdio). Install as an MCP tool in Claude Code / Cursor and ask: *"score this MCP server"* → structured verdict.
+
+## Validation targets (own dogfood set)
+
+Phase 1 uses three real MCP servers written by the author to bootstrap the calibration:
+
+1. **domain-pre-flight** (11 tools, mature) — reference for Layer A footprint norms
+2. **rag-db-advisor** — smaller surface
+3. **opencut-mcp** (v0.1.0) — brand-new MCP, expected clean baseline
+4. **mcp-scorecard itself** — dogfooding, README badge
+
+## Non-goals (v0.1)
+
+- Runtime behaviour analysis / fuzzing
+- Auto-fix
+- Registry-wide scanning (crawling MCP.so etc.) — separate future project
+- Payment / licensing checks
+
+## Roadmap
+
+- **v0.1** — Layer A + B full, Layer C own rules only, Layer D bundled list. CLI + MCP server.
+- **v0.2** — MCP-Scan wrap, SARIF output, protocol negotiation via real client
+- **v0.3** — Book『MCP実践セキュリティ』章別ルール取り込み
+- **v0.4** — Registry-source scanning (github: / pypi: / npm: targets)

mcp_scorecard-0.1.1/pyproject.toml

@@ -0,0 +1,68 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "mcp-scorecard"
+version = "0.1.1"
+description = "Pre-flight checks for MCP servers: passive token footprint, use-case scoping, security, and name safety. LLM-facing quality scorecard."
+readme = "README.md"
+license = { text = "MIT" }
+authors = [{ name = "Ken Imoto" }]
+requires-python = ">=3.10"
+keywords = ["mcp", "model-context-protocol", "audit", "security", "token", "llm", "pre-flight"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Topic :: Software Development :: Quality Assurance",
+]
+dependencies = [
+    "click>=8.1",
+    "rich>=13.7",
+    "tiktoken>=0.7",
+    "Levenshtein>=0.25",
+    "pyyaml>=6.0",
+]
+
+[project.optional-dependencies]
+mcp = [
+    "mcp>=1.2",
+]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=5.0",
+    "pytest-mock>=3.12",
+    "mypy>=1.10",
+    "ruff>=0.5",
+]
+
+[project.urls]
+Homepage = "https://github.com/kenimo49/mcp-scorecard"
+Repository = "https://github.com/kenimo49/mcp-scorecard"
+Issues = "https://github.com/kenimo49/mcp-scorecard/issues"
+Funding = "https://github.com/sponsors/kenimo49"
+
+[project.scripts]
+mcp-scorecard = "mcp_preflight.cli:main"
+mpf = "mcp_preflight.cli:main"
+mcp-scorecard-mcp = "mcp_preflight.mcp_server:run"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/mcp_preflight"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "N", "UP", "B", "C4", "SIM"]
+ignore = ["E501"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]