# Reported issues for securityscorecard-mcp

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [securityscorecard-mcp](/mcp/securityscorecard-mcp).

## Most discussed

### get_score_improvement_roadmap

get_score_improvement_roadmap❌ 
Still broken
N/A Same JavaScript error

[Read the thread](https://github.com/CallMarcus/security-scorecard-mcp/issues/38) · 2025-08-04 · closed · 1 comment

### Roadmap: adopt MCP protocol revision 2026-07-28 (SDK v2 migration)

Tracking issue for adopting the MCP **2026-07-28** protocol revision. Assessment summary (2026-07-28):

**Nothing is broken today.** This server is stdio-only and tools-only — the surface this revision touched least. v1-SDK servers keep working with all current clients via version negotiation, and the deprecation policy guarantees a 12-month window. The migration is about staying current, not fixing breakage.

**What changed upstream:**
- Protocol is now stateless: no `initialize` handshake, ver

[Read the thread](https://github.com/CallMarcus/security-scorecard-mcp/issues/201) · 2026-07-28 · open · 0 comments

### Update docs for SDK v2: CLAUDE.md, README, MCP client config examples

## Why

CLAUDE.md and README reference "MCP SDK v1.29.0+" and the old `@modelcontextprotocol/sdk` package/import paths. After the v2 migration (#198) these become stale — same class of drift as the hardcoded endpoint count we have been bitten by before.

## Changes

- [ ] CLAUDE.md: SDK version/package references, `McpServer` import paths, Node version, dependency list
- [ ] README: install/usage snippets, badges, Node requirement
- [ ] Re-verify per-client MCP config examples (Claude Desktop et

[Read the thread](https://github.com/CallMarcus/security-scorecard-mcp/issues/199) · 2026-07-28 · open · 0 comments

### Migrate to MCP TypeScript SDK v2 (@modelcontextprotocol/server) and serve protocol 2026-07-28

## Why

The MCP spec revision **2026-07-28** shipped alongside a new v2 SDK package family. `@modelcontextprotocol/sdk` v1 is now the legacy line (maintenance mode). Our exposure is small — stdio-only, tools-only, no Roots/Sampling/Logging — but staying current matters for the npm + MCP registry listing.

Key upstream references:
- Spec changelog: https://modelcontextprotocol.io/specification/2026-07-28/changelog
- SDK migration guide: [`docs/migration/upgrade-to-v2.md`](https://github.com/model

[Read the thread](https://github.com/CallMarcus/security-scorecard-mcp/issues/198) · 2026-07-28 · open · 0 comments

### Drop Node 18 support; require Node >= 20

## Why

- Node 18 has been EOL since April 2025.
- The MCP TypeScript SDK v2 (`@modelcontextprotocol/server`) requires Node >= 20 (`engines` field), so this is a hard prerequisite for the SDK v2 migration.

## Changes

- [ ] `package.json`: set `"engines": { "node": ">=20" }`
- [ ] `.github/workflows/node.js.yml`: change CI matrix from `18.x / 20.x / 22.x` to `20.x / 22.x / 24.x`
- [ ] README / CLAUDE.md: update the "Node.js >=18 required" statements

## Notes

Independent of the SDK migration —

[Read the thread](https://github.com/CallMarcus/security-scorecard-mcp/issues/197) · 2026-07-28 · closed · 0 comments

### Upgrade to TypeScript 6.x (blocked on tsconfig moduleResolution)

Dependabot proposed TypeScript 5.9.3 → 6.0.3 (#169), but it fails the build:

```
tsconfig.json(5,25): error TS5107: Option 'moduleResolution=node10' is
deprecated and will stop functioning in TypeScript 7.0. Specify
compilerOption '"ignoreDeprecations": "6.0"' to silence this error.
```

TypeScript 6 promotes the `"moduleResolution": "node"` (node10) deprecation from a warning to a hard error.

### Why it's not urgent
Production builds use **esbuild** (`build:fast`), not `tsc`. `tsc` only runs 

[Read the thread](https://github.com/CallMarcus/security-scorecard-mcp/issues/176) · 2026-06-08 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/CallMarcus/security-scorecard-mcp/issues).