mcptrustchecker
Active·★ 172·MIT·Updated 2026-07-26
MCP Trust Checker is a local-first, deterministic security scanner that evaluates the safety of Model Context Protocol (MCP) servers. It utilizes a unique Capability-Flow Trust Model to statically identify potential data exfiltration paths and other vulnerabilities before you connect servers to sensitive data.
#Security Scanner#Static Analysis#Trust Model#Supply Chain Security#Vulnerability Detection#AI Assistant Security#Node.js#CLI Tool
01
Features
01Offline by Default: Operates without requiring an account, token, API key, or hosted service, ensuring data privacy.
02Cross-Tool Toxic-Flow Graph: Identifies lethal trifecta scenarios where untrusted input, sensitive data, and external exfiltration paths coexist across multiple tools.
03Deep-Scans Published Packages: Fetches, verifies, and analyzes the actual published source code from npm/PyPI without installation or execution.
04Auditable Trust Score: Provides a deterministic A-F grade with a transparent scoring methodology, including penalty vectors and confidence levels.
05Rug-Pull Integrity: Detects post-approval mutations of tool definitions and verifies package artifact hashes to prevent silent changes.
02
Compatibility
Node.js
Runtime
Verified via docs
npm
Package Manager
Verified via docs
PyPI
Package Manager
Verified via docs
GitHub Actions
CI/CD
Verified via docs
03
Quick start
1
$ npm i -g mcptrustchecker
04
Use cases
↳Scanning already installed MCP servers or local package directories for vulnerabilities.
↳Auditing live HTTP/SSE or OAuth-protected remote MCP endpoints before integration.
↳Integrating into CI/CD pipelines (e.g., GitHub Actions) to enforce security gates and generate SARIF reports.
↳Embedding the scanning engine into marketplaces or platforms to verify the security of listed MCP servers.
↳Using the free hosted web API for quick, zero-install security checks of tool manifests or published packages.
05
Alternatives
mcpsec★ 27
An AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI) before your AI agents do.
cc-audit★ 26
AI-free static security scanner for Claude Code artifacts (Skills, Hooks, MCP configs). Detects data exfiltration, prompt injection, and supply chain risks with deterministic, reproducible results.
rolecraft★ 95
The security-first skill manager for AI agents — every install runs a security scan. Manage skills & MCP servers across 87 agents. Zero-dependency CLI.
hackmyagent★ 83
Metasploit for AI agents: scan, attack, and fix AI agents and MCP servers. Open source security toolkit.
hol-guard★ 963
AI antivirus for developer agents: protect Codex, Claude Code, Cursor, Gemini, OpenCode, plugins, skills, MCP servers, and AI harnesses before tools run.
ai-security-tool★ 1.0k
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
Comments
Log in to leave a comment
No comments yet. Be the first!