{"name":"io.github.trustlists/mcp","slug":"trustlists-mcp","title":"trustlists","description":"Find public vendor trust centers, analyze SOC 2 reports, and request trust-center access.","url":"https://mcp.market/server/trustlists-mcp","rating":null,"grade":"A","score":94,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":26,"stars":0,"forks":0,"downloads_week":45,"last_push_at":"2026-10-03T04:45:58.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/trustlists/trustlists-plugin","website":"https://trustlists.org/mcp/","version":"0.3.0","remotes":[],"packages":[{"registryType":"npm","identifier":"@trustlists/mcp","version":"0.3.0","transport":{"type":"stdio"}}],"tools":[{"name":"trustlists_access_continue","description":"After the user finishes in the live browser (needs_buyer), hand the access request back to the runner. Requires trustlists_login.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_access_request","description":"Request access to a vendor trust center (SafeBase or Vanta only; requires trustlists_login). Resolves the vendor in the public directory, creates a vendor review if needed, then queues the request. First call previews. Call again with confirm: true to submit. If the requester profile is incomplete, update it with trustlists_requester_profile first.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_access_request_batch","description":"Request access to up to … vendor trust centers in one confirmed batch (requires trustlists_login). One confirm covers the list. Requests are enqueued one at a time. Do not invent a larger parallel farm. First call previews; call again with confirm: true to submit.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_access_status","description":"Check trust-center access request progress. Pass jobIds from trustlists_access_request, or omit to list recent jobs. When a job is needs_buyer, the result includes the live browser URL and takeover_expires_at. Requires trustlists_login.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_audit_dependencies","description":"Scan a project's dependency manifests (package.json, requirements.txt, go.mod, Cargo.toml, Gemfile, composer.json, pyproject.toml, Pipfile) and map likely vendors to public trust center records. Returns documentation-visibility data, not a security score. Use when inventorying third-party services or preparing vendor review.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_browse","description":"Browse the public trustlists directory by exact trust center platform, listed framework, or CSA STAR level. Use for questions like \"show SafeBase-hosted vendors\", \"find entries listing ISO 27001\", or \"list CSA STAR Level 2 companies\". Results are directory metadata, not security ratings.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_login","description":"Sign in to a trustlists account so this MCP can run SOC 2 analyses and trust-center access requests. Uses a device code: show the user the returned URL and code, then call again with the returned deviceCode if the result is still pending. Free directory tools never need this.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_logout","description":"Sign out of the trustlists account connected to this MCP and delete the stored credentials.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_lookup","description":"Look up one company in the public trustlists directory by exact website domain. Returns its trust center URL, platform, listed frameworks, CSA STAR level, verification date, and directory page. Directory metadata is a discovery aid, not proof of compliance.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_requester_profile","description":"Get or update the requester profile used on vendor trust-center access forms (requires trustlists_login). Pass fullName, company, role, phone, and termsAccepted to save. Returns complete/missing so a blocked access request can be fixed in chat.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_search","description":"Search thousands of public trust center records by company name or website domain. Returns directory matches with trust center URLs, platforms, listed frameworks, CSA STAR levels, and source pages. Use when the user gives a company name or partial domain.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_soc2_analyze","description":"Analyze one or more local SOC 2 report PDFs with trustlists (requires trustlists_login). First call uploads the files and returns a credit cost preview without charging. Call again with confirmCredits set to the returned total to queue the analysis. Results also appear in the trustlists app.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_soc2_report","description":"Fetch a completed SOC 2 analysis as a short summary, the full markdown report, or raw JSON. Requires trustlists_login.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_soc2_status","description":"Check SOC 2 analysis job progress. Pass one or more jobIds from trustlists_soc2_analyze, or omit to list recent jobs. Requires trustlists_login.","write_action":false,"price_micros":0,"input_schema":null},{"name":"trustlists_whoami","description":"Show which trustlists account this MCP is signed in as, remaining credits, and whether the requester profile needed for access requests is complete.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":94,"grade":"A","scanned_at":"2026-10-30T06:00:42.330Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-30T06:00:42.253Z","components":{"code":{"score":25,"max":25,"notes":["29 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 27 days ago"]},"identity":{"score":9,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"@trustlists/mcp","version":"0.3.0","found":true,"license":"Apache-2.0","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-10-03T00:34:41.138Z","repositoryUrl":"git+https://github.com/trustlists/trustlists-plugin.git","weeklyDownloads":45}],"repo":{"found":true,"owner":"trustlists","repo":"trustlists-plugin","archived":false,"pushedAt":"2026-10-03T04:45:58Z","stars":0,"forks":0,"openIssues":6,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/240602113?v=4","ownerCreatedAt":"2025-10-28T00:19:21Z","license":"Apache-2.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/240602113?v=4&s=128","source":"registry","width":128,"height":128},"presence":{"stars":0,"forks":0,"downloadsWeek":45,"license":"Apache-2.0","lastPushAt":"2026-10-03T04:45:58.000Z","score":26}}}},"grade_history":[],"reviews":[]}