SCORECARD

Open source · MPL-2.0 · v0.1.0

One verdict for your code, from the tools you already run.

Scorecard runs your project's build, tests, lint, coverage, dependency and secret checks, scores each gate, and returns pass or fail. No hosted service, no account.

git clone https://github.com/moonbase2090/Scorecard cargo install --path Scorecard/crates/sc-cli
Download for macOS Download for Linux View on GitHub
Real sc 0.1.0 output, unedited; icons and verdict color added.

How it works

Three steps, one answer.

  1. 01

    Install

    Build the sc CLI from source with cargo. Prebuilt macOS and Linux builds will come with the first tagged release.

  2. 02

    Run sc analyze .

    Scorecard picks a pack from your project's manifests and runs its real tools. For Rust that's cargo check, cargo test, cargo llvm-cov and cargo clippy.

  3. 03

    Get a verdict

    Each gate passes or fails, and the exit code is the verdict: 0 pass, 1 a gate failed, 2 the analyzer couldn't run. A terminal gets the scorecard shown above; a pipe gets JSON. --format and --out write JSON, Markdown, SARIF or HTML reports.

What it checks

Quality gates, using your project's own build, test and lint tools.

Quality gates
GateChecksFails the run

Language packs

A pack maps each gate to the right tools for a language. --pack picks one when several manifests match. Rust enforces the full set above; other packs enforce fewer gates.

Scores

Four scores from 0 to 1, reported alongside the gates. Efficiency and security stay at 1.0 until their engines exist.

Reading a result

  • passCircle with a check: the gate passed
  • failSquare with a cross: the gate failed

Works where you work

The same gates for your agent, your CI and your terminal.

Agents · MCP

Let agents check their own work

sc setup installs the agent skill and registers the sc-mcp server for your user, so coding agents can run Scorecard and read the verdict before they hand work back.

cargo install --path crates/sc-mcp
sc setup
CI · GitHub Action

Gate pull requests

Run the same analysis in GitHub Actions and fail the check when a gate fails. Writes sc-results.sarif by default.

- uses: moonbase2090/Scorecard/action@[[ACTION_REF]]
macOS · Linux

Run it on your machine

Build from source with cargo today. A signed macOS .dmg and macOS and Linux tarballs are planned for the first tagged release.

Install options →

Local-first

Runs on your machine, with no account needed.

Runs locally

Analysis happens on your machine or your CI runner. The optional --llm on spec review, off by default, calls an OpenAI-compatible API: a local endpoint (127.0.0.1:11434) unless you set XAI_API_KEY, which sends it to api.x.ai.

No trackers here

This website has no trackers, analytics or cookies. It only remembers your light or dark theme choice, in your browser.

No account

No sign-up and no hosted service. Install it and point it at a repo. An API key is only needed if you turn on --llm with xAI.

Open source

Written in Rust and licensed under MPL-2.0. Read the source.

Install

Install Scorecard

Current version: 0.1.0, not yet tagged. Until the first release, install from source.

With cargo

git clone https://github.com/moonbase2090/Scorecard cd Scorecard cargo install --path crates/sc-cli cargo install --path crates/sc-mcp

Requires Rust 1.85 or newer. sc-mcp is only needed for agents.

Rust coverage also needs

rustup component add llvm-tools cargo install cargo-llvm-cov

Then, in any repo

sc analyze .

Independent systems / The maker

Moonbase2090

Moonbase2090 builds Scorecard. The source is available under the Mozilla Public License 2.0 (MPL-2.0).

Visit Moonbase 2090 (opens in a new tab)