Connectors · Identity & security
SecurityScorecard MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to SecurityScorecard and the rest of your systems. It gives your agent 597 SecurityScorecard actions (494 reads, 73 writes and 30 that wait for a confirmation) and holds the SecurityScorecard credential itself, so the agent never does. It paces SecurityScorecard's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "securityscorecard.scorecard_tags.list", intent: "check which SecurityScorecard account is connected"}# Get all scorecard tags · read · 1 upstream call- 597actionsin one signed file
- 494readlook, never change
- 73writecreate and update
- 30wait for a yesdestructive, confirmed first
Set up
Connect SecurityScorecard in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect SecurityScorecard.
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
api_tokenSecurityScorecard API token: platform.securityscorecard.io > My Settings > API (or Settings > API for a bot user) >…
account { op: "connections.requirements", service: "securityscorecard" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "securityscorecard.scorecard_tags.list" }# get all scorecard tags · read · 1 upstream callcheck { action: "securityscorecard.all_companies.update", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
SecurityScorecard at a glance
- Sign-in
- API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
api_token- Limits we pace to
- 300 calls a minute, per connection
- API covered
- SecurityScorecard API 1.9 (OpenAPI 3.0)
api.securityscorecard.io - Built from
- SecurityScorecard's documentation, read 23 October 2026securityscorecard.readme.ioplatform-api.securityscorecard.io
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 479 of 494 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line SecurityScorecard up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in SecurityScorecard.
597 actions in 489 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 494readlook, never change
- 73writecreate and update
- 30destructivewait for a confirmation
Reports
121 read · 11 write · 0 destructive
Get reports you have generated recently · Generate a Company Detailed report · Generate a Company Events report · Generate a CSV containing Scorecard Domains
Ip domain tags groups
72 read · 3 write · 2 destructive
Get all ip domain tag groups · Get an ip domain tag group · Add ip domain tag to an ip domain tag group · Create a new ip domain tag group
All companies
62 read · 2 write · 2 destructive
Find followed companies · Get followed company by domain · Update followed company by domain · Delete followed company by domain
Ip domain tags
63 read · 2 write · 1 destructive
Get all ip domain tags · Get all the domain tags of the parent domain · Get all the ip tags of the parent domain · Create an ip domain tag
Portfolios companies
62 read · 2 write · 2 destructive
Get all companies in a portfolio · portfolios_companies.list_v2 · Add company to portfolio · Add companies in bulk to a portfolios
All companies custom fields
51 read · 3 write · 1 destructive
all_companies_custom_fields.list · all_companies_custom_fields.create · all_companies_custom_fields.bulk_edit · all_companies_custom_fields.update
Plans
52 read · 2 write · 1 destructive
Get plans list · Get list of managed action plans for managed customers vendors · Archive list of plans by ID · Unarchive list of plans by ID
Scorecard tags
51 read · 2 write · 2 destructive
Get all scorecard tags · Create a scorecard tag · Update a scorecard tag · Delete a scorecard tag
112 more areas · 545 actions
- Scorecard tags groups 5
- Vendor detection 5
- Company issues 4
- Custom scorecards 4
- Max partner managed customers updates 4
- Multiscores 4
- Portfolios 4
- All companies custom field values 3
- Companies 3
- Max customer documents 3
- Max partner documents 3
- Max partner findings 3
- Max partner likelihood assessments 3
- Max partner managed customers 3
- Max partner managed customers vendor updates 3
- Max partner vendors 3
- Scorecard tags companies 3
- All companies monitoring level 2
- App jobs 2
- Asi 2
- Company events 2
- Company issue feedback 2
- Compliance frameworks 2
- Custom scorecards filters 2
- Custom scorecards sources 2
- Ip domain tags domains 2
- Ip domain tags ips 2
- Issue types 2
- Max partner breaches 2
- Max partner managed customers access 2
- Max partner reports 2
- Max partner vendor onboarding 2
- Plans factor score improvement 2
- Plans guests 2
- Plans issue resolution 2
- Plans overall score improvement 2
- Scorecard tags all companies 2
- Scorecard tags groups members 2
- All companies monitoring status 1
- Asi asset ports 1
- Asi assets 1
- Asi cves 1
- Asi details active infections 1
- Asi details cve 1
- Asi details ransomware 1
- Asi details threat actor 1
- Audit API logs 1
- Companies active issues 1
- Companies expanded risk 1
- Companies factors 1
- Companies summary factors 1
- Company breach events 1
- Company factor score history 1
- Company issue context 1
- Company issue events 1
- Company profiles 1
- Company score history 1
- Company score plans 1
- Company scores 1
- Factors 1
- Footprint attribution log 1
- Industry factor history 1
- Industry factors 1
- Industry score history 1
- Industry scores 1
- Invitations 1
- Issue events active cve exploitation attempted 1
- Issue events adware installation 1
- Issue events adware installation trail 1
- Issue events alleged breach incident 1
- Issue events attack detected 1
- Issue events attempted information leak 1
- Issue events browser logs contain debug message 1
- Issue events CDN hosting 1
- Issue events cobalt strike C2 detected 1
- Issue events cobalt strike C2 service 1
- Issue events communication server with expired cert 1
- Issue events communication with server certificate issued by blacklisted country 1
- Issue events compromised by information stealer 1
- Issue events compromised credentials found 1
- Issue events contact information detected 1
- Issue events cookie missing HTTP only 1
- Issue events cookie missing secure attribute 1
- Issue events CSP no policy V2 1
- Issue events CSP too broad V2 1
- Issue events CSP unsafe policy V2 1
- Issue events cve in use by threat actor 1
- Issue events data leak detected 1
- Issue events dmarc contains none 1
- Issue events dmarc record missing 1
- Issue events domain missing https V2 1
- Issue events dos attack attempt detected 1
- Issue events exploit attempt detected 1
- Issue events exploited product 1
- Issue events exposed cisco web UI 1
- Issue events exposed embedded iot web server 1
- Issue events exposed mac airport device 1
- Issue events exposed network attached storage device 1
- Issue events exposed personal information info 1
- Issue events exposed printer 1
- Issue events fail to load page components 1
- Issue events general scan detected 1
- Issue events historical compromised credentials found 1
- Issue events hosted on object storage V2 1
- Issue events HSTS incorrect V2 1
- Issue events industrial control device 1
- Issue events infected by targeted attack 1
- Issue events insecure FTP 1
- Issue events insecure https redirect pattern V2 1
- Issue events insecure server certificate key size 1
- Issue events insecure telnet 1
- 370 smaller areas 370
Top actions
The SecurityScorecard API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 12 of SecurityScorecard's 12 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
securityscorecard.all_companies.listFind followed companies | Searches followed companies by any of the allowed fields. | read | crm.company.list162 connectors |
securityscorecard.scorecard_tags.listGet all scorecard tags | Get all scorecard tags. | read | crm.tag.list65 connectors |
securityscorecard.all_companies.getGet followed company by domain | Fetch a company by its domain. | read | crm.company.get162 connectors |
securityscorecard.all_companies.updateUpdate followed company by domain | Updates any of the followed company allowed fields. | write | crm.company.update137 connectors |
securityscorecard.scorecard_tags.createCreate a scorecard tag | Create a scorecard tag. | write | crm.tag.create49 connectors |
securityscorecard.all_companies.deleteDelete followed company by domain | Removes the company from portfolios and watchlists and deletes the associated data. | destructive | crm.company.delete119 connectors |
securityscorecard.scorecard_tags.updateUpdate a scorecard tag | Update a scorecard tag. | write | crm.tag.update40 connectors |
securityscorecard.audit_api_logs.listaudit_api_logs.list | Get API Logs. | read | security.audit_log.list69 connectors |
securityscorecard.compliance_frameworks.listGet all available compliance frameworks | Get all available compliance frameworks. | read | security.framework.list5 connectors |
securityscorecard.company_breach_events.listGet a company's historical breaches events | Get a company's historical breaches events. | read | security.breach_record.list3 connectors |
securityscorecard.compliance_frameworks.getGet a compliance framework details | Get a compliance framework details. | read | security.framework.get4 connectors |
securityscorecard.asi.facetsAttack Surface Intelligence API Facets | Attack Surface Intelligence API Facets. | read | this connector |
Try it
Prompts to paste into Claude.
Each one names the SecurityScorecard actions it will call, so you know what it reads and what it changes before you send it.
- Readread
List the companies in SecurityScorecard and flag likely duplicates by name or domain.
calls
securityscorecard.all_companies.list - Writewrite
Update followed company by domain in SecurityScorecard. Show me exactly what you will send before you save it.
calls
securityscorecard.all_companies.update
Governance for SecurityScorecard
Destructive actions wait for a yes.
30 SecurityScorecard actions are destructive. These are all of them:
- Delete followed company by domain
securityscorecard.all_companies.delete - Delete a scorecard tag
securityscorecard.scorecard_tags.delete - Delete plan by ID
securityscorecard.plans.delete - Delete a portfolio
securityscorecard.portfolios.delete - scim_users.delete
securityscorecard.scim_users.delete - Remove item from plan
securityscorecard.plans_items.remove - Remove guests from plan by ID
securityscorecard.plans_guests.remove - Delete an ip domain tag
securityscorecard.ip_domain_tags.delete - Delete a custom scorecard
securityscorecard.custom_scorecards.delete - Execute bulk delete operation on followed companies
securityscorecard.all_companies.bulk_delete - Remove a tag from an ip
securityscorecard.ip_domain_tags_ips.remove - max_partner_vendors.delete
securityscorecard.max_partner_vendors.delete - Deletes a list of tags by the given ids in a singl
securityscorecard.scorecard_tags.bulk_delete - Remove company from portfolio
securityscorecard.portfolios_companies.remove - Delete an ip domain tag group
securityscorecard.ip_domain_tags_groups.delete - Remove ip domain tag to an ip domain tag group
securityscorecard.ip_domain_tags_groups.remove - max_partner_documents.delete
securityscorecard.max_partner_documents.delete - Delete a scorecard tag group
securityscorecard.scorecard_tags_groups.delete - Remove a tag from a domain
securityscorecard.ip_domain_tags_domains.remove - max_partner_reports.bulk_delete
securityscorecard.max_partner_reports.bulk_delete - Remove all companies from a portfolio
securityscorecard.portfolios_companies.remove_all - Remove a scorecard tag from a company
securityscorecard.scorecard_tags_companies.remove - Delete custom scorecard filters
securityscorecard.custom_scorecards_filters.remove - Delete custom scorecard sources
securityscorecard.custom_scorecards_sources.remove - all_companies_custom_fields.delete
securityscorecard.all_companies_custom_fields.delete - Remove a managed customer and delete its managed portfolio
securityscorecard.max_partner_managed_customers.delete - Remove scorecard tag from a scorecard tag group
securityscorecard.scorecard_tags_groups_members.remove - Removes the given tags from the given companies
securityscorecard.scorecard_tags_all_companies.bulk_remove - Delete updates for a managed customer
securityscorecard.max_partner_managed_customers_updates.delete - Delete vendor updates for a managed customer
securityscorecard.max_partner_managed_customers_vendor_updates.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete followed company by domain?
intent: the user asked me to delete followed company by domain
account { op: "keys.create", name: "securityscorecard-agent", allowed_actions: ["securityscorecard.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "securityscorecard.all_companies.delete", approver: "[email protected]" }, { match: "securityscorecard.scorecard_tags.delete", approver: "[email protected]" }, { match: "securityscorecard.plans.delete", approver: "[email protected]" } ]}Cost
What SecurityScorecard costs on actionlake.
Every SecurityScorecard action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call SecurityScorecard refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 597 SecurityScorecard actions
- 597actions pageeach page of a long list is one call
- 479reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every SecurityScorecard action.
597 actions by area: the id your agent calls, what it does, and its effect.
Reports12
securityscorecard.reports.generate_detailedGenerate a Company Detailed reportwritesecurityscorecard.reports.generate_events_jsonGenerate a Company Events reportwrite- and 10 more in this area
Ip domain tags groups7
securityscorecard.ip_domain_tags_groups.addAdd ip domain tag to an ip domain tag groupwritesecurityscorecard.ip_domain_tags_groups.createCreate a new ip domain tag groupwrite- and 5 more in this area
All companies6
securityscorecard.all_companies.deleteDelete followed company by domaindestructivesecurityscorecard.all_companies.getGet followed company by domainread- and 4 more in this area
Ip domain tags6
securityscorecard.ip_domain_tags.createCreate an ip domain tagwritesecurityscorecard.ip_domain_tags.listGet all ip domain tagsread- and 4 more in this area
Portfolios companies6
securityscorecard.portfolios_companies.addAdd company to portfoliowritesecurityscorecard.portfolios_companies.bulk_addAdd companies in bulk to a portfolioswrite- and 4 more in this area
All companies custom fields5
securityscorecard.all_companies_custom_fields.bulk_editall_companies_custom_fields.bulk_editwritesecurityscorecard.all_companies_custom_fields.createall_companies_custom_fields.createwrite- and 3 more in this area
Plans5
securityscorecard.plans.archiveArchive list of plans by IDwritesecurityscorecard.plans.getGet list of managed action plans for managed customers vendorsread- and 3 more in this area
Scorecard tags5
securityscorecard.scorecard_tags.createCreate a scorecard tagwritesecurityscorecard.scorecard_tags.deleteDelete a scorecard tagdestructive- and 3 more in this area
Scorecard tags groups5
securityscorecard.scorecard_tags_groups.createCreate a new scorecard tag groupwritesecurityscorecard.scorecard_tags_groups.getGet a scorecard tag groupread- and 3 more in this area
Vendor detection5
securityscorecard.vendor_detection.list_fourth_partiesGet fourth party vendors by domainreadsecurityscorecard.vendor_detection.list_portfolioGet third party vendors by portfolio IDread- and 3 more in this area
Company issues4
securityscorecard.company_issues.listcompany_issues.listreadsecurityscorecard.company_issues.list_paginatedcompany_issues.list_paginatedread- and 2 more in this area
Custom scorecards4
securityscorecard.custom_scorecards.createCreate a custom scorecardwritesecurityscorecard.custom_scorecards.deleteDelete a custom scorecarddestructive- and 2 more in this area
Max partner managed customers updates4
securityscorecard.max_partner_managed_customers_updates.createmax_partner_managed_customers_updates.createwritesecurityscorecard.max_partner_managed_customers_updates.deleteDelete updates for a managed customerdestructive- and 2 more in this area
Multiscores4
securityscorecard.multiscores.batchmultiscores.batchreadsecurityscorecard.multiscores.getmultiscores.getread- and 2 more in this area
Portfolios4
securityscorecard.portfolios.createCreate a new portfoliowritesecurityscorecard.portfolios.deleteDelete a portfoliodestructive- and 2 more in this area
All companies custom field values3
securityscorecard.all_companies_custom_field_values.bulk_setall_companies_custom_field_values.bulk_setwritesecurityscorecard.all_companies_custom_field_values.listall_companies_custom_field_values.listread- and 1 more in this area
Companies3
securityscorecard.companies.bulk_searchSearch companies in bulkreadsecurityscorecard.companies.createcompanies.createwrite- and 1 more in this area
Max customer documents3
securityscorecard.max_customer_documents.getmax_customer_documents.getreadsecurityscorecard.max_customer_documents.listmax_customer_documents.listread- and 1 more in this area
Max partner documents3
securityscorecard.max_partner_documents.deletemax_partner_documents.deletedestructivesecurityscorecard.max_partner_documents.getmax_partner_documents.getread- and 1 more in this area
Max partner findings3
securityscorecard.max_partner_findings.get_reportmax_partner_findings.get_reportreadsecurityscorecard.max_partner_findings.listmax_partner_findings.listread- and 1 more in this area
Max partner likelihood assessments3
securityscorecard.max_partner_likelihood_assessments.createmax_partner_likelihood_assessments.createwritesecurityscorecard.max_partner_likelihood_assessments.getmax_partner_likelihood_assessments.getread- and 1 more in this area
Max partner managed customers3
securityscorecard.max_partner_managed_customers.deleteRemove a managed customer and delete its managed portfoliodestructivesecurityscorecard.max_partner_managed_customers.getmax_partner_managed_customers.getread- and 1 more in this area
Max partner managed customers vendor updates3
securityscorecard.max_partner_managed_customers_vendor_updates.createmax_partner_managed_customers_vendor_updates.createwritesecurityscorecard.max_partner_managed_customers_vendor_updates.deleteDelete vendor updates for a managed customerdestructive- and 1 more in this area
Max partner vendors3
securityscorecard.max_partner_vendors.deletemax_partner_vendors.deletedestructivesecurityscorecard.max_partner_vendors.listmax_partner_vendors.listread- and 1 more in this area
Scorecard tags companies3
securityscorecard.scorecard_tags_companies.addAdd a scorecard tag to a companywritesecurityscorecard.scorecard_tags_companies.listGet all companies associated with a scorecard tagread- and 1 more in this area
All companies monitoring level2
securityscorecard.all_companies_monitoring_level.bulk_setall_companies_monitoring_level.bulk_setwritesecurityscorecard.all_companies_monitoring_level.setall_companies_monitoring_level.setwrite
App jobs2
securityscorecard.app_jobs.createCreates an app jobwritesecurityscorecard.app_jobs.updateUpdate a jobwrite
Asi2
securityscorecard.asi.facetsAttack Surface Intelligence API Facetsreadsecurityscorecard.asi.searchAttack Surface Intelligence API Searchread
Company events2
securityscorecard.company_events.listcompany_events.listreadsecurityscorecard.company_events.list_v2company_events.list_v2read
Company issue feedback2
securityscorecard.company_issue_feedback.createSend new feedback on findings from a specific issuewritesecurityscorecard.company_issue_feedback.request_validationSend a new feedback validation request on findingswrite
Compliance frameworks 2Custom scorecards filters 2Custom scorecards sources 2Ip domain tags domains 2Ip domain tags ips 2Issue types 2Max partner breaches 2Max partner managed customers access 2Max partner reports 2Max partner vendor onboarding 2Plans factor score improvement 2Plans guests 2Plans issue resolution 2Plans overall score improvement 2Scorecard tags all companies 2Scorecard tags groups members 2All companies monitoring status 1Asi asset ports 1Asi assets 1Asi cves 1Asi details active infections 1Asi details cve 1Asi details ransomware 1Asi details threat actor 1Audit API logs 1Companies active issues 1Companies expanded risk 1Companies factors 1Companies summary factors 1Company breach events 1Company factor score history 1Company issue context 1Company issue events 1Company profiles 1Company score history 1Company score plans 1Company scores 1Factors 1Footprint attribution log 1Industry factor history 1Industry factors 1Industry score history 1Industry scores 1Invitations 1Issue events active cve exploitation attempted 1Issue events adware installation 1Issue events adware installation trail 1Issue events alleged breach incident 1Issue events attack detected 1Issue events attempted information leak 1Issue events browser logs contain debug message 1Issue events CDN hosting 1Issue events cobalt strike C2 detected 1Issue events cobalt strike C2 service 1Issue events communication server with expired cert 1Issue events communication with server certificate issued by blacklisted country 1Issue events compromised by information stealer 1Issue events compromised credentials found 1Issue events contact information detected 1Issue events cookie missing HTTP only 1Issue events cookie missing secure attribute 1Issue events CSP no policy V2 1Issue events CSP too broad V2 1Issue events CSP unsafe policy V2 1Issue events cve in use by threat actor 1Issue events data leak detected 1Issue events dmarc contains none 1Issue events dmarc record missing 1Issue events domain missing https V2 1Issue events dos attack attempt detected 1Issue events exploit attempt detected 1Issue events exploited product 1Issue events exposed cisco web UI 1Issue events exposed embedded iot web server 1Issue events exposed mac airport device 1Issue events exposed network attached storage device 1Issue events exposed personal information info 1Issue events exposed printer 1Issue events fail to load page components 1Issue events general scan detected 1Issue events historical compromised credentials found 1Issue events hosted on object storage V2 1Issue events HSTS incorrect V2 1Issue events industrial control device 1Issue events infected by targeted attack 1Issue events insecure FTP 1Issue events insecure https redirect pattern V2 1Issue events insecure server certificate key size 1Issue events insecure telnet 1370 smaller areas 370
This index shows a sample of each area. All 597 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The SecurityScorecard MCP server, answered.
Is there a SecurityScorecard MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 597 SecurityScorecard actions across reports, ip domain tags groups, all companies and ip domain tags, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by SecurityScorecard.
What do I need to connect SecurityScorecard?
SecurityScorecard API token: platform.securityscorecard.io > My Settings > API (or Settings > API for a bot user) >…. The free call account { op: "connections.requirements", service: "securityscorecard" } lists exactly what to paste.
Can an AI agent delete or change things in SecurityScorecard?
Only if its key allows it, and only with an explicit confirmation. 30 SecurityScorecard actions are destructive, including delete followed company by domain, delete a scorecard tag and delete plan by ID. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my SecurityScorecard API limit?
actionlake paces every call to the limits in the SecurityScorecard service file: 300 calls a minute per connection. Repeated reads are answered from cache (479 SecurityScorecard actions can be), which never reaches SecurityScorecard.
What does a SecurityScorecard action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (597 SecurityScorecard actions page). Cache hits, searches, dry runs and calls SecurityScorecard refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which SecurityScorecard API does it cover?
The SecurityScorecard API 1.9 (OpenAPI 3.0) at api.securityscorecard.io. It is built from SecurityScorecard's documentation as read on 23 October 2026. 597 actions in 489 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my SecurityScorecard data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your SecurityScorecard credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent SecurityScorecard today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
