TrustScan MCP server

• read_skillFree

  Read a product skill file by its skill:// URI.

• skills_list_toolFree

  List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

• trust_scan_fileFree

  Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.

• trust_scan_serverFree

  Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 540ms20/20
• Tool poisoning4 tool descriptions checked15/15
• Auth qualityopen endpoint, read-only tools10/15
• Maintenancerepository not readable: repo not found3/15
• Maintainer identityno repository or website to verify2/10

TrustScan: common questions

Is TrustScan MCP server safe?

With care: it is graded C, so read the findings first (67/100). Read the TrustScan safety report

How do I install TrustScan?

It runs remotely at trust-scan-production.up.railway.app. Add it to Claude Code, Claude Desktop or Cursor with the snippets above, or call it through the mcp.market gateway without installing anything.

Does TrustScan need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is TrustScan maintained?

The latest release is v0.1.0.

Is TrustScan up?

100% of our last 2 checks got an answer. We check remote servers about four times a day.

What can I use instead of TrustScan?

Servers from other publishers that do the same job: MCP Security & Vulnerability Auditor MCP server, ScanLabsAI Security Scanner MCP server and CodeInspectus MCP server. Compare all TrustScan alternatives.