{"name":"io.github.entradox/trust-scan","slug":"entradox-trust-scan","title":"TrustScan","description":"Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.","url":"https://mcp.market/server/entradox-trust-scan","rating":null,"grade":"C","score":67,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":8,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":2,"ok":2,"last_checked_at":"2026-09-19T23:16:03.150Z","last_ok_at":"2026-09-19T23:16:03.150Z","latency_ms":224},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/entradox/trust-scan","website":"https://github.com/entradox/trust-scan","version":"0.1.0","remotes":[{"type":"streamable-http","url":"https://trust-scan-production.up.railway.app/mcp/"}],"packages":[],"tools":[{"name":"read_skill","description":"Read a product skill file by its skill:// URI.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"uri":{"type":"string","description":"e.g. skill://<product>/<skill-name>/SKILL.md\n Get valid URIs from `skills_list_tool`."}},"required":["uri"],"additionalProperties":false}},{"name":"skills_list_tool","description":"List this product's skills. Each entry carries the SKILL.md URI,\nits name and description, verbatim frontmatter, and a per-file\nsha256 manifest. Read a body with `read_skill`.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"trust_scan_file","description":"Security-scan a single file for invisible Unicode, dangerous patterns, and secrets.\n\nReturns a severity-weighted score and per-finding detail (rule, severity,\nlocation). Read-only: the file is never modified.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"filepath":{"type":"string","description":"absolute path of the file to scan"}},"required":["filepath"],"additionalProperties":false}},{"name":"trust_scan_server","description":"Security-scan an MCP server or skill package before trusting it.\n\nRuns all four checks — invisible Unicode prompt-injection, dangerous code\npatterns (MCP001–006), hardcoded secrets, typosquat package names — and\nreturns a 0-100 score, letter grade, and detailed findings. Run this on\nany directory BEFORE wiring it into your agent. Read-only: never modifies\nthe scanned target.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"path":{"type":"string","description":"directory or file path to scan (on the TrustScan host)"},"package_name":{"default":"","type":"string","description":"package name for typosquat detection (e.g. \"mcp-server\")"}},"required":["path"],"additionalProperties":false}}],"scan":{"score":67,"grade":"C","scanned_at":"2026-09-20T00:29:05.446Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T00:29:05.436Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 540ms"]},"poisoning":{"score":15,"max":15,"notes":["4 tool descriptions checked"]},"auth":{"score":10,"max":15,"notes":["open endpoint, read-only tools"]},"maintenance":{"score":3,"max":15,"notes":["repository not readable: repo not found"]},"identity":{"score":2,"max":10,"notes":["no repository or website to verify"]}},"findings":[],"inputs":{"probes":[{"url":"https://trust-scan-production.up.railway.app/mcp/","reachable":true,"authRequired":false,"latencyMs":540,"serverInfo":{"name":"trust-scan","version":"4.0.3"}}],"packages":[],"repo":{"found":false,"owner":"entradox","repo":"trust-scan","error":"repo not found"},"icon":{"url":null,"source":"none"},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":8}}}},"grade_history":[],"reviews":[]}