mcpscore

# Local servers (stdio, including modern-only stateless servers)
mcpscore path/to/server.py
mcpscore path/to/server.js

# Local servers in any language: --stdio runs an arbitrary command
# (it consumes the rest of the line, so put mcpscore options first)
mcpscore --stdio ./my-go-server
mcpscore --stdio java -jar server.jar

# Server env vars: NAME=VALUE inline for plain config; for secrets use
# the value-less form, which copies from mcpscore's own environment so
# the value never touches a command line or the report
mcpscore --env LOG_LEVEL=debug --stdio dotnet run --project ./server
API_KEY=... mcpscore --env API_KEY --stdio ./my-go-server

# Remote servers (Streamable HTTP / SSE, auto-detected —
# including modern-only servers on the 2026 stateless lifecycle)
mcpscore https://example.com/mcp

# Machine-readable report for CI
mcpscore https://example.com/mcp --json > report.json

# Gate any CI on a threshold: exit code 3 when the score percentage is below it
mcpscore https://example.com/mcp --fail-under 80

# Auth-gated servers: pass a token to audit behind the gate
mcpscore https://example.com/mcp --token "$MY_TOKEN"
mcpscore https://example.com/mcp --header "Authorization: Bearer $MY_TOKEN"

# Published packages: score the npm/PyPI listing without running it
mcpscore --package npm:@your-scope/your-server
mcpscore --package pypi:your-server

Audit finished. Final score: 78/91
Spec: 2025-11-25 negotiated (latest: 2026-07-28) · era: legacy
Readiness for MCP 2026-07-28: 3/13 (informative — not part of the main score; 4 of 21 checks assessed)