trustlists MCP server

by trustlists·io.github.trustlists/mcp·v0.3.0

No reviews yet

Find public vendor trust centers, analyze SOC 2 reports, and request trust-center access.

A94/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A94/100

full report

Adoption

Growing

0 stars45 downloads/wk

Reviews

Write one

Nobody has reviewed trustlists yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

trustlists tools (15)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

trustlists_access_continue
After the user finishes in the live browser (needs_buyer), hand the access request back to the runner. Requires trustlists_login.
trustlists_access_request
Request access to a vendor trust center (SafeBase or Vanta only; requires trustlists_login). Resolves the vendor in the public directory, creates a vendor review if needed, then queues the request. First call previews. Call again with confirm: true to submit. If the requester profile is incomplete, update it with trustlists_requester_profile first.
trustlists_access_request_batch
Request access to up to … vendor trust centers in one confirmed batch (requires trustlists_login). One confirm covers the list. Requests are enqueued one at a time. Do not invent a larger parallel farm. First call previews; call again with confirm: true to submit.
trustlists_access_status
Check trust-center access request progress. Pass jobIds from trustlists_access_request, or omit to list recent jobs. When a job is needs_buyer, the result includes the live browser URL and takeover_expires_at. Requires trustlists_login.
trustlists_audit_dependencies
Scan a project's dependency manifests (package.json, requirements.txt, go.mod, Cargo.toml, Gemfile, composer.json, pyproject.toml, Pipfile) and map likely vendors to public trust center records. Returns documentation-visibility data, not a security score. Use when inventorying third-party services or preparing vendor review.
trustlists_browse
Browse the public trustlists directory by exact trust center platform, listed framework, or CSA STAR level. Use for questions like "show SafeBase-hosted vendors", "find entries listing ISO 27001", or "list CSA STAR Level 2 companies". Results are directory metadata, not security ratings.
trustlists_login
Sign in to a trustlists account so this MCP can run SOC 2 analyses and trust-center access requests. Uses a device code: show the user the returned URL and code, then call again with the returned deviceCode if the result is still pending. Free directory tools never need this.
trustlists_logout
Sign out of the trustlists account connected to this MCP and delete the stored credentials.
trustlists_lookup
Look up one company in the public trustlists directory by exact website domain. Returns its trust center URL, platform, listed frameworks, CSA STAR level, verification date, and directory page. Directory metadata is a discovery aid, not proof of compliance.
trustlists_requester_profile
Get or update the requester profile used on vendor trust-center access forms (requires trustlists_login). Pass fullName, company, role, phone, and termsAccepted to save. Returns complete/missing so a blocked access request can be fixed in chat.
trustlists_search
Search thousands of public trust center records by company name or website domain. Returns directory matches with trust center URLs, platforms, listed frameworks, CSA STAR levels, and source pages. Use when the user gives a company name or partial domain.
trustlists_soc2_analyze
Analyze one or more local SOC 2 report PDFs with trustlists (requires trustlists_login). First call uploads the files and returns a credit cost preview without charging. Call again with confirmCredits set to the returned total to queue the analysis. Results also appear in the trustlists app.
trustlists_soc2_report
Fetch a completed SOC 2 analysis as a short summary, the full markdown report, or raw JSON. Requires trustlists_login.
trustlists_soc2_status
Check SOC 2 analysis job progress. Pass one or more jobIds from trustlists_soc2_analyze, or omit to list recent jobs. Requires trustlists_login.
trustlists_whoami
Show which trustlists account this MCP is signed in as, remaining credits, and whether the requester profile needed for access requests is complete.

Public scan report

scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it

no findings

Code scan29 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 27 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Overall 94/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How trustlists compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 94/100; higher than 96% of 48,243 servers
Tools: 15; the typical server has 7
Tools that change things: 0%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 45; more than 35% of 12,306 servers with a package

What its tools let an agent do: 15 read

Release history: 2 versions in the registry since 2026-08-30, latest 2026-10-03, typically one every 34 days.

Install trustlists in Claude Code, Cursor or VS Code

Runs npx -y @trustlists/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp -- npx -y @trustlists/mcp

Add to Cursor

What the publisher says

From the trustlists repository's README, as published. We do not edit it. Read it on GitHub

trustlists_ Plugin

Public vendor trust center tools for Cursor and Claude Code. Find trust centers, browse listed frameworks, and map project dependencies without leaving your editor.

What it does

The trustlists_ plugin gives your AI assistant access to thousands of public company trust center records and tools for mapping project dependencies to vendor security-documentation pages.

Tools

Skills

The plugin ships with skills your AI assistant uses automatically:

lookup-vendor - Find a vendor's trust center and listed frameworks
audit-dependencies - Map project dependencies to public trust center records
compliance-quick-check - Check whether a directory record lists a requested framework

Example usage

In Cursor or Claude Code, just ask:

"Look up Stripe's trust center"

"Audit my package.json for vendor security"

"Does Datadog's trust center list HIPAA information?"

The AI uses the plugin's tools to answer with current public trustlists data. A directory record is a discovery aid, not an audit, certification, endorsement, or security rating.

Quick Install (Cursor, Claude Desktop, Claude Code)

Add this to your MCP config and restart:

{
  "mcpServers": {
    "trustlists": {
      "command": "npx",
      "args": ["-y", "@trustlists/mcp"]
    }
  }
}

Full installation guide → (includes troubleshooting)

Pricing

The four directory tools are free and require no trustlists account. SOC 2 analysis and other account-based workflows live in trustlists Companion.

Free MCP tools - Search, lookup, browse, and dependency mapping
Companion - Account-based SOC 2 analysis, favorites, sharing, and vendor follow-up

Visit the MCP overview for setup and tool details, or trustlists.org for the full directory and Companion subscriptions.

Development

# Install dependencies
npm install

# Build the MCP server
npm run build

# Test locally
npm run test:local

See docs/development.md for the full development guide.

License

Apache 2.0. See LICENSE and NOTICE.

trustlists: common questions

Is trustlists MCP server safe?: Yes, by our scan: it is graded A (94/100). Read the trustlists safety report
How do I install trustlists?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does trustlists need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is trustlists maintained?: The last commit was 33 days ago (2026-10-03). The latest release is v0.3.0.
How does trustlists compare with other MCP servers?: safety score 94/100 (higher than 96% of 48,243 servers); tools 15 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.