Open source · MIT · v0.2.1
Scorecard runs your project's build, tests, lint, coverage, dependency and secret checks, scores each gate, and returns pass or fail. No hosted service, no account.
git clone \
https://github.com/moonbase2090/Scorecard
cargo install --locked --path Scorecard/crates/sc-cli
v0.2.1 · SHA256SUMS · all downloads
Since v0.1.6: SARIF uploads work with Node 24, and generated-header scans can no longer be bypassed.
sc 0.1.15; icons and verdict color added.
How it works
Download the signed macOS disk image or a macOS or Linux tarball from the v0.2.1 release, or build the sc CLI from source with cargo.
sc analyze .Scorecard picks a pack from your project's manifests and runs its real tools. For Rust that's cargo check, cargo test, cargo llvm-cov and cargo clippy.
Each gate passes or fails, and the exit code is the verdict: 0 pass, 1 a gate failed, 2 the analyzer couldn't run. A terminal gets the scorecard shown above; a pipe gets JSON. --format and --out write JSON, Markdown, SARIF or HTML reports.
HTML report
--format html writes a self-contained report that makes no network requests. The flow strip across the top reads left to right, from what was analyzed to the verdict.
sc analyze . --format html --out scorecard.html
sc 0.1.15 HTML reports, cropped to the flow strip: testdata/good_crate (pass) and testdata/failing_test (fail). Open the full reports: good_crate · failing_test · HTML report docsWhat it checks
| Gate | Checks | Fails the run |
|---|
A pack maps each gate to the right tools for a language. --pack picks one when several manifests match. Rust enforces types, tests, crap, secrets and lint. The web pack enforces html. Other packs enforce fewer gates.
Five scores from 0 to 1, reported alongside the gates. An error lowers its score by 0.25 and a warning by 0.05. A dependency warning lowers security by 0.01. A missing coverage record is reported and does not change the score.
Works where you work
sc setup installs the agent skill and registers the sc-mcp server for your user, so coding agents can run Scorecard and read the verdict before they hand work back.
cargo install --locked --path crates/sc-mcp
sc setupRun the same analysis in GitHub Actions and fail the check when a gate fails. Writes sc-results.sarif by default.
- uses: moonbase2090/Scorecard/action@v0.2.1A signed and notarized universal macOS .dmg, plus tarballs for macOS and Linux on x86_64 and aarch64.
Local-first
Analysis happens on your machine or your CI runner. The optional --llm on spec review, off by default, calls an OpenAI-compatible API: a local endpoint (127.0.0.1:11434) unless you set XAI_API_KEY, which sends it to api.x.ai.
This website has no trackers, analytics or cookies. It only remembers your light or dark theme choice, in your browser.
No sign-up and no hosted service. Install it and point it at a repo. An API key is only needed if you turn on --llm with xAI.
Written in Rust and licensed under the MIT License. Read the source.
Install
Current version: 0.2.1. Downloads are on GitHub Releases; check them against SHA256SUMS.
macOS: the universal disk image is signed and notarized. It contains Install Scorecard.pkg, which installs sc and sc-mcp to /usr/local/bin. Requires macOS 11 or later on Apple silicon, or macOS 10.12 or later on Intel. Tarballs: tar -xzf sc-v0.2.1-<target>.tar.gz unpacks a sc-v0.2.1-<target> folder; from inside it, run sudo install -m 755 sc sc-mcp /usr/local/bin/. Linux: x86_64 and aarch64 builds target glibc (*-unknown-linux-gnu). Check downloads against SHA256SUMS, or see all downloads.
$ git clone https://github.com/moonbase2090/Scorecard $ cd Scorecard $ cargo install --locked --path crates/sc-cli $ cargo install --locked --path crates/sc-mcp
Requires Rust 1.88 or newer. sc-mcp is only needed for agents. Rust coverage also needs rustup component add llvm-tools and cargo install cargo-llvm-cov.
sc analyze .Independent systems / The maker
Moonbase2090 builds Scorecard. The source is available under the MIT License, copyright Moonbase 2090 LLC.