**Lighthouse为MCP计分。**在MCP服务器上得分MCPSCORE并获得加分 一份需要修正的清单，每个发现都引用了其来源：MCP规范， RFC、MCP 注册表模式，或明确的最佳实践。

缺少工具名称、过时的协议版本，或接受 任何Origin都不会让你的服务器崩溃。这会让代理选错工具， 或者让恶意网页与你的服务器通信。MCPSCORE 会先发现这些 你的用户需要。它是确定性的，不需要API密钥，也不需要注册。

文档：docs.mcpscore.dev

安装

使用 uv 时，uvx mcpscore 无需安装即可运行。Node 用户可以运行 npx @mcp-box/mcpscore 与 UV 或 PIPX 接在 PATH 上;NPM 包启动 这个Python引擎（npm配置）。

审计你的第一个服务器

就这样。服务器有分了。

每个✅或❌是一个规则：一个检定，比如security_origin_validation，使得 通过或未通过。每个❌都带有一行Fix:。92/109表示服务器 获得了其规则可获得的109分中的92分。不适用于的规则 这个服务器被跳过，也被排除在109号之外，所以服务器永远不会被列入 因为它没有的特性而被扣分。

审计你机器上的服务器

mcpscore

Lighthouse for MCP. Point mcpscore at an MCP server and get a score plus a list of what to fix, each finding cited to its source: the MCP spec, an RFC, the MCP Registry schema, or a stated best practice.

A missing tool title, a stale protocol version, or an endpoint that accepts any Origin never crashes your server. It makes agents pick the wrong tool, or lets a malicious web page talk to your server. mcpscore finds those before your users do. It is deterministic and needs no API key and no sign-up.

Documentation: docs.mcpscore.dev

Install

pip install mcpscore

With uv, uvx mcpscore runs it without installing. Node users can run npx @mcp-box/mcpscore with uv or pipx on PATH; the npm package launches this Python engine (npm setup).

Audit your first server

mcpscore https://mcp.deepwiki.com/mcp

Welcome to mcpscore!
Successfully connected to MCP server via Streamable HTTP: https://mcp.deepwiki.com/mcp
Transport: streamable-http
Starting the audit...
✅ Protocol version "2025-11-25" is one of the allowed versions.
❌ Server title is not present in server info. This is an optional quality recommendation. First affected field: server "/serverInfo/title".
  Fix: Add a human-readable serverInfo.title so clients can display a recognizable server name.
✅ Server uses HTTPS with valid TLS (TLSv1.3).
❌ Streamable HTTP does not reject an invalid foreign Origin with HTTP 403, risking DNS rebinding. Observed HTTP status: 200.
  Fix: Validate supplied Origin headers against the origins allowed for this endpoint. Return HTTP 403 for invalid origins; do not allow every origin to satisfy browser requests.
...
Audit finished. Final score: 96/114
Spec: 2025-11-25 negotiated (latest: 2026-07-28) · era: legacy
Readiness for MCP 2026-07-28: 3/13 (informative — not part of the main score; 4 of 21 checks assessed)

That’s it. The server has a score.

Each ✅ or ❌ is one rule: one check, like security_origin_validation, that passed or failed. Every ❌ carries a Fix: line. 96/114 means the server earned 96 of the 114 points its rules can award. Rules that cannot apply to this server are skipped and left out of the 114, so a server is never penalized for a feature it does not have.

Audit a server on your machine