mcpscore-plugin MCP server
Commit Nov 11, 2026Audits and fixes MCP servers directly within coding agents like Claude Code, Codex, or Cursor by providing cited scores and automated code corrections.
Also known as mcp-box/mcpscore-plugin
- Stars
- 1
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Nov 11, 2026
- License
- MIT
What is mcpscore-plugin MCP?
mcpscore-plugin audits and fixes MCP servers directly within coding agents like Claude Code, Codex, or Cursor by providing cited scores and automated code corrections.
Summary generated from the project's README
About mcpscore-plugin MCP server
Auditing and repairing Model Context Protocol servers directly within your coding environment is what mcpscore-plugin enables for developers using Claude Code, Codex, or Cursor. By integrating with these agents, the plugin allows you to run an audit on a server URL, a local file, or a command via stdio. It provides a specific score in points and identifies failed rules by citing the relevant specification requirements.
Once an audit is complete, the tool can automatically fix issues within your server code while ensuring tool annotations and descriptions remain accurate to the implementation. It then performs a re-audit to demonstrate the score improvement. To use this, you must have uv or pipx installed on your PATH. For servers requiring authentication, you can export an MCPSCORE_TOKEN to your environment to keep credentials secure. The plugin is designed to be private, communicating only with the server being audited and fetching necessary OAuth discovery documents.
What you can do with it
- 1Fixing server code errorsHave the agent automatically correct code issues found during the audit process.
- 2Verifying audit improvementsCompare the quality of your server before and after applying automated fixes.
- 3Testing local server commandsRun an audit on a server running via a local command like a python script.
Written from the project's README. Every use case is checked against a quote from it.
README
View on GitHubmcpscore for coding agents
Audit the MCP server you're building without leaving Claude Code, Codex or Cursor. Ask "audit my MCP server" and the agent runs mcpscore, explains the score and each failed rule with its spec citation, fixes what it can in your own server code, and re-audits to show the score before and after.
Install
| Agent | Install |
|---|---|
| Claude Code | /plugin install mcpscore --marketplace mcp-box/mcpscore-plugin |
| Codex | codex plugin marketplace add mcp-box/mcpscore-plugin, then codex plugin add mcpscore@mcpscore |
| Cursor | copy plugins/mcpscore to ~/.cursor/plugins/local/mcpscore, then run Developer: Reload Window |
| Any agent that reads Agent Skills | copy plugins/mcpscore/skills/audit to your agent's skills folder |
The skill runs the mcpscore CLI with uv
(uvx mcpscore), so uv must be on your PATH. pipx works too.
The agent asks before each audit. To let it re-audit the server you're
building without asking, allow that one exact command. In Claude Code, add it
to permissions.allow in your settings, with your own server in place of the
example:
"Bash(uvx mcpscore@latest --json https://your-server.example/mcp)"
Don't end the rule with a wildcard (:* or *). mcpscore can start any
command (--stdio), read a token from any file (--token-file) and call a
server's tools (--smoke), so a wildcard rule lets anything that steers the
agent, such as text from an audited server, do all of that without a prompt.
With the exact rule, every other target and every extra option still asks.
Use
Audit my MCP server at https://example.com/mcp
Check the MCP server in this folder and fix what you safely can
/mcpscore:audit --stdio uv run server.py
The skill:
- Runs
mcpscore --json <target>on a server URL, a local server file, or a server command (--stdio). It audits only a server you named, and asks before starting a local server it found in your workspace. - Reports the score in points (
153/171 (89%)) and the failed rules, most severe first, each with what was observed, the fix, and the requirement it comes from. - With your go-ahead, fixes your own server code, keeping tool annotations and descriptions true to what the code does.
- Re-audits and shows the score before and after.
It never calls your server's tools unless you ask (--smoke), and it never
writes a credential into a file. For a server behind a bearer token, export
MCPSCORE_TOKEN before you start the agent: mcpscore reads it from the
environment, so the token stays off the command line.
Privacy
The plugin sends nothing to mcpscore.dev. The CLI talks to the server you audit, and fetches the public OAuth discovery documents that server points to, which can be on other hosts. See PRIVACY.md.
Security
Report vulnerabilities privately; see SECURITY.md.
Development
make install # uv sync --all-groups
make all # what CI runs: lint, types, tests, plugin validation, workflow audit
make eval # the agent eval suite: runs real Claude sessions on your account
plugins/mcpscore/ is the plugin. The repository root holds the marketplace
manifests for each agent (.claude-plugin/, .agents/plugins/,
.cursor-plugin/). scripts/check_plugin.py keeps those manifests, the skill,
and the mcpscore report fields the skill reads consistent with each other.
License
MIT. See LICENSE.
mcpscore-plugin MCP questions
How do I install this in Claude Code?
Run the command /plugin install mcpscore --marketplace mcp-box/mcpscore-plugin within the agent.
Does the plugin send my data to mcpscore.dev?
No, the plugin does not send anything to mcpscore.dev; the CLI communicates directly with the server you are auditing.
How can I handle servers that require a bearer token?
Export the MCPSCORE_TOKEN environment variable before starting your agent so the token remains off the command line.