TrustScan MCP server

• read_skillFree

  Read a product skill file by its skill:// URI.

• skills_list_toolFree

  List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

• trust_scan_fileFree

  Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.

• trust_scan_serverFree

  Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 372ms20/20
• Tool poisoning4 tool descriptions checked15/15
• Auth qualityopen endpoint, read-only tools10/15
• Maintenancerepository not readable: repo not found3/15
• Maintainer identityno repository or website to verify2/10

Safety score

67/100

higher than 25% of 915 Security servers

Tools

4

the typical Security server has 6

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote Security server answers 100%

Response time

110 ms

faster than 83% of 547 Security servers

TrustScan: common questions

Is TrustScan MCP server safe?

With care: it is graded C, so read the findings first (67/100). Read the TrustScan safety report

How do I install TrustScan?

It runs remotely at trust-scan-production.up.railway.app. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does TrustScan need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is TrustScan maintained?

The latest release is v0.1.0.

Is TrustScan up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of TrustScan?

Servers from other publishers that do the same job: SafeWeave MCP server, Zn Gate MCP server and Bawbel Scanner MCP server.

How does TrustScan compare with other Security MCP servers?

safety score 67/100 (higher than 25% of 915 Security servers); tools 4 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.