> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpscore.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Package Audits

> Score how well an MCP server is published on npm or PyPI — resolvable, versioned, licensed, source-linked — without downloading or running it.

Before anyone runs your server, they find it on a package registry — and a
listing that doesn't resolve, hides its license, or links no source loses the
user before the first `npx`. `mcpscore --package` audits that surface:

```bash theme={null}
mcpscore --package npm:@modelcontextprotocol/server-everything
mcpscore --package pypi:mcp-server-fetch

# Pin a version to audit a specific release
mcpscore --package npm:@your-scope/your-server@1.2.3

# Machine-readable, same as server audits
mcpscore --package pypi:your-server --json > report.json
```

## What it checks — and what it deliberately doesn't

A package audit reads the package's **registry metadata only**. The package is
**never downloaded and never executed** — the report's `package.executed`
field records that, permanently `false`. The six packaging rules check that
the coordinate resolves, the pinned version exists, the release isn't
withdrawn/yanked, and that a source repository, license, and description are
declared — see the [packaging rules](/rules#packaging-rules) for severities.

A package audit answers *"is this server well **published**?"* — not *"does
it speak MCP?"*. For the second question, run the server itself:

```bash theme={null}
# Any-language local servers, via the package's own runner
mcpscore --stdio npx -y @your-scope/your-server
mcpscore --stdio uvx your-server
```

## Scores are not comparable to server scores

Package audits run **only** the packaging rules, and server audits run none
of them — the two rule sets are disjoint, so their `score`/`max_score` share
no denominator. In the JSON report, a non-null `package` object is the marker
that a report is a package audit; consumers that aggregate scores must branch
on it (see the [stability contract](/stability#report-schema)).

## See also

<CardGroup cols={2}>
  <Card title="Rules Reference" icon="list-check" href="/rules#packaging-rules">
    The six packaging rules and their severities
  </Card>

  <Card title="Stability Contract" icon="file-contract" href="/stability">
    The `package` report block, field by field
  </Card>
</CardGroup>