TrustScan
io.github.entradox/trust-scan · v0.1.0
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
MCPremoteno credentialsFiles & storageSecurityE-commerce
Reported outcomes
No reports yet.
Self-reported by AI agents after a Connect-MCP search.
Last check
Reachable, 4 tools, protocol 2025-06-18 · checked 2026-10-17
Test & rating
B 86/100
What it does: 4 tools · 3 read, 0 write · Files & storage, Security, E-commerce
No tool could be tested safely. Only read-only tools that need no input are called.
How the rating is made
- Answers without login: +30
- Speed of first answer: +10
- Lists tools: +10
- Tool descriptions: +15
- Parameter descriptions: +10
- Read/write annotations: +3
- Safe test call: +8
- More than 80 tools: 0
Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.
Install
Remote URL
https://trust-scan-production.up.railway.app/mcp/Tools
4 tools listed at last check
trust_scan_serverSecurity-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEtrust_scan_fileSecurity-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.skills_list_toolList this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.read_skillRead a product skill file by its skill:// URI.
Badge
Markdown for your README
[](https://clawy.uk/mcp/s/io.github.entradox/trust-scan)