TrustScan MCP Server

by entradox Your server? Claim it

answering

TrustScan is answering right now. Last checked 7 min ago. It exposes 4 tools.

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

The linked repository no longer exists on GitHub — it was deleted or made private.

Uptime history 49 days of history · worst day 76%

49 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

358 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 4

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 14 September 2026. No other catalogue keeps this.

13 Oct a tool changed version

8 Oct a tool changed version

14 Sep 2 tools appeared read_skill, skills_list_tool

This one has been quiet for a while

Quiet is not dead — but it is worth knowing when it wakes up, or when someone else takes it over. We watch the repository and tell you either way.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 7 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add trust-scan --transport http https://trust-scan-production.up.railway.app/mcp/

Settings → Connectors → Add custom connector, then paste this address

https://trust-scan-production.up.railway.app/mcp/

~/.codex/config.toml

[mcp_servers.trust-scan]
url = "https://trust-scan-production.up.railway.app/mcp/"

.cursor/mcp.json

{
  "mcpServers": {
    "trust-scan": {
      "url": "https://trust-scan-production.up.railway.app/mcp/"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "trust-scan": {
      "type": "http",
      "url": "https://trust-scan-production.up.railway.app/mcp/"
    }
  }
}

Available tools 4

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

trust

trust_scan_file

Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.

trust_scan_server

Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.

skill

read_skill

Read a product skill file by its skill:// URI.

skills

skills_list_tool

List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

Endpoints

URL	Transport	State	Latency	Checked
https://trust-scan-production.up.railway.app/mcp/	streamable-http	answering	340 ms	7 min ago

Alternatives to TrustScan

same job, measured the same way

MCP Shield

by sophiacave

Security scanner for MCP servers. SSRF, path traversal, injection, auth, secrets. Grade A-F.

14 installs/wk local only

Mcpshield

by mcpshield-dev

Security scanner for MCP servers - detects tool poisoning and injection

22 installs/wk local only

Mund — MCP Security Scanner

by tyox-all

Scan for prompt injection, secrets, PII, and vet MCP servers before installation

55 installs/wk local only

Hares — MCP security scanner

by alialrikabi313

Multi-layer security scanner for MCP servers and agent skills (injection, exfiltration)

21 installs/wk local only

Skill Audit MCP

by eltociear

MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.

11 tools answering

Aguara MCP

by garagon

Security scanner for AI agent skills and MCP servers

local only

Shadowgate MCP

by josephibra

Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.

answering

Mcpsentry

by roshan6335

Security scanner and runtime proxy for MCP servers.

28 installs/wk local only

TrustScan — questions

Answers built from our own checks of this server.

What can TrustScan do?

It exposes 4 tools, read directly from the server on our last check. Among them: read_skill, skills_list_tool, trust_scan_file, trust_scan_server. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is TrustScan working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 358 ms. The bar chart above shows every period we have measured.

Is TrustScan still maintained?

The linked repository no longer exists on GitHub — it was deleted or made private. We show this because it changes what you can expect: an unmaintained server may keep answering for months and then stop without warning.

How do I connect TrustScan?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does TrustScan need an API key?

No. TrustScan completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 4 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is TrustScan?

It answers our handshake in 358 ms on average, which is faster than 42% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.