Skip to main content
A missing tool title, a stale protocol version, or an endpoint that accepts any Origin never crashes your MCP server. Agents pick the wrong tool, registries rank you lower, and browsers can reach a server they should not. mcpscore finds those problems in seconds and tells you how to fix each one. It needs no API key and no sign-up. This page audits a server on a URL. For a server you run locally over stdio, start with Audit a local server.

​
Quick start

Run mcpscore against DeepWiki’s public MCP server. The uvx command needs uv. The npx command needs Node.js and also uv or pipx on PATH, because it launches the Python engine in an isolated environment (npm setup).
The first run takes a few seconds longer while the runner downloads the engine. Then you see the audit:
That’s it. Swap in your own server’s URL and you have its score. Each ❌ is one finding, and the Fix: line under it says what to change. When a finding is about one field, the next line names it. Run the same command again after a fix and the score moves.

​
Reading the result

  • 87/103 is points earned over points available. A rule is one check, like “server title is present”. Each rule has a severity, and a failed rule costs its weight: CRITICAL 5, HIGH 3, MEDIUM 2, LOW 1. A rule that cannot apply to your server is skipped and removed from the maximum, so it never counts against you.
  • era: legacy names the MCP lifecycle the server speaks. mcpscore scores a server against the spec revision it negotiated, never one it does not speak yet.
  • Readiness is a second score: how ready the server is for the 2026-07-28 revision. For a legacy server like DeepWiki it is guidance and stays out of the main score. For a server already on the stateless lifecycle, those points count in the main score.
  • The same server gets the same score on the same mcpscore version. The stability contract says what may change between versions.
The methodology covers the four categories (Protocol · Primitives · Security & Auth · Readiness) and how each rule is weighted.

​
What’s next

Audit a local server

Score a stdio server in any language, in its own environment

Improve your score

The findings most servers fail, and the fix for each

Authenticated servers

Audit behind a token or the browser OAuth flow

GitHub Action

Gate pull requests on the score, with the report as a comment

Smoke mode

Call your server’s tools after every change and check they behave

CLI reference

Every flag, exit code, and report field