SecurityScorecard MCP server

What the model can do

SecurityScorecard security ratings: portfolios of monitored vendors with each company's grade, score and 30-day change, a company's scorecard with factor grades and issue counts by severity, score history, score-change and issue events, a followed vendor's lifecycle, risk and contract details, tags and scorecard notes; when asked, can create, rename or delete portfolios, add a company to a portfolio or remove it, create tags and tag or untag companies, update a vendor's lifecycle, risk and contract details, or stop following a vendor.

Reads

• securityscorecard_list_portfoliosSecurityScorecard portfolios (groups of monitored companies, usually vendors): id, name, description and who can see them.
• securityscorecard_portfolio_companiesCompanies in one SecurityScorecard portfolio with their grade (A to F), score (0 to 100), 30-day score change, industry, size…
• securityscorecard_get_scorecardOne company's SecurityScorecard rating by domain (any company, not only monitored ones): grade, score, 30-day change, industry…
• securityscorecard_score_historyA company's SecurityScorecard score over time, by domain: one score per day in the window (default the last 90 days), with the first, last…
• securityscorecard_score_eventsWhat moved a company's SecurityScorecard score, by domain: issue events (an issue type appearing, resolving or departing, with its factor, severity…
• securityscorecard_get_followed_companyYour own record of a followed company (vendor) in SecurityScorecard, by domain: lifecycle status, business impact, risk, business unit…
• securityscorecard_list_tagsSecurityScorecard scorecard tags (labels put on companies): id, name and description.
• securityscorecard_scorecard_notesNotes your team wrote on a company's scorecard in SecurityScorecard, by domain, newest first: the note text…

Acts, when you ask

These change something in SecurityScorecard. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• securityscorecard_create_portfolioCreates a SecurityScorecard portfolio.
• securityscorecard_update_portfolioRenames a SecurityScorecard portfolio or changes its description or who can see it (private, shared with the organisation, or team).
• securityscorecard_delete_portfolioPermanently deletes a SecurityScorecard portfolio; everyone it was shared with loses it.
• securityscorecard_add_company_to_portfolioAdds a company, by its primary domain, to a SecurityScorecard portfolio, which starts monitoring it…
• securityscorecard_remove_company_from_portfolioRemoves a company from a SecurityScorecard portfolio, so it is no longer monitored there…
• securityscorecard_create_tagCreates a scorecard tag in SecurityScorecard, shared with the organisation, for labelling companies.
• securityscorecard_tag_companyPuts a SecurityScorecard tag on a company, by tag id and the company's domain.
• securityscorecard_untag_companyTakes a SecurityScorecard tag off a company, by tag id and the company's domain.
• securityscorecard_update_vendorUpdates your record of a followed company (vendor) in SecurityScorecard: lifecycle status, business impact, risk, business unit, data types shared…
• securityscorecard_unfollow_companyStops following a company in SecurityScorecard: it is removed from every portfolio and watchlist and the vendor data you kept on it (lifecycle, risk…

Connect it

First connect SecurityScorecard on Dashboard → Connections, then add Memtro to your client once. The SecurityScorecard tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared SecurityScorecard connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › Which vendors' scores fell in the last 30 days?
• › What is northwind.com's grade, and which factors are weakest?
• › Why did acme.com's score drop last week?
• › When does our payroll vendor's contract end?
• › Which companies are in the critical vendors portfolio?

Questions

Is this an official SecurityScorecard MCP server?

No. It is Memtro's MCP server with Memtro's SecurityScorecard connector behind it: the connector reads SecurityScorecard through its API with the credentials you connect on Dashboard → Connections, and SecurityScorecard publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in SecurityScorecard?

Only when you ask, and only what it has been granted: create a portfolio; rename a portfolio or change its description or sharing; delete a portfolio; add a company to a portfolio (starts monitoring it); remove a company from a portfolio; create a scorecard tag; tag a company; remove a tag from a company; update a vendor's lifecycle, risk, business unit and contract details; stop following a company and delete its vendor data. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server