MCP Trust & Tool-Poisoning Audit MCP Server

by tylerscomic-lab Your server? Claim it

answering

MCP Trust & Tool-Poisoning Audit is answering right now. Last checked 9 min ago. Last commit 2 Oct 2026.

Audit MCP servers for tool poisoning and shadowing. Scan a remote server by URL or paste its tools.

Uptime history 32 days of history · worst day 99%

32 days agonow

100.0%

Uptime 24h

91 of 91 checks

—

Tools

hidden behind auth

544 ms

Response time

average over 24h

Stars

last commit 2 Oct 2026

What the code does

We read the source, 3 d ago · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Touches key and credential files server.js:110

const SENSITIVE_PATH_RE = /(~\/\.ssh|\.ssh\/id_rsa|\.aws\/credentials|\/etc\/passwd|\.env\b|\.netrc\b|\.npmrc\b|id_rsa|\.git-credentials|\.docker\/config\.json)/i;

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add mcp-trust-audit-mcp --transport http https://mcp-trust-audit-mcp.mcpize.run/mcp

Settings → Connectors → Add custom connector, then paste this address

https://mcp-trust-audit-mcp.mcpize.run/mcp

~/.codex/config.toml

[mcp_servers.mcp-trust-audit-mcp]
url = "https://mcp-trust-audit-mcp.mcpize.run/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-trust-audit-mcp": {
      "url": "https://mcp-trust-audit-mcp.mcpize.run/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "mcp-trust-audit-mcp": {
      "type": "http",
      "url": "https://mcp-trust-audit-mcp.mcpize.run/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URL	Transport	State	Latency	Checked
https://mcp-trust-audit-mcp.mcpize.run/mcp	streamable-http	sign-in	417 ms	9 min ago

Alternatives to MCP Trust & Tool-Poisoning Audit

same job, measured the same way

Mcpshield

by mcpshield-dev

Security scanner for MCP servers - detects tool poisoning and injection

43 installs/wk local only

Mcpcheck

by joeyough

Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.

2 tools answering

mcp-audit

by firatmio

Transparent audit proxy for MCP servers: logs every tool call, flags poisoning and rug pulls.

45 installs/wk local only

MCP Tool Poisoning Scanner

by marcepalacios12

Scan MCP servers for tool poisoning, hidden instructions and silent tool changes. Runs on Apify.

answering

MCP Security Guard

by petrovicistefan

Audit MCP servers for tool poisoning, rug pulls and supply-chain risk (OWASP MCP Top 10).

111 installs/wk local only

Entropy0dev

by entropy0dev

Entropy0 MCP server — source trust and URL safety tools for AI agents

40 installs/wk local only

Palanit Core

by stasxr

Scan MCP servers and agent tool manifests for poisoning, exfiltration, secrets and supply-chain risk

162 installs/wk local only

toolprint by JEStats

by jestatsio

package-lock.json for MCP trust: catch MCP rug-pulls, tool poisoning, and leaked secrets.

91 installs/wk local only

MCP Trust & Tool-Poisoning Audit — questions

Answers built from our own checks of this server.

Why is there no tool list for MCP Trust & Tool-Poisoning Audit?

The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.

Is MCP Trust & Tool-Poisoning Audit working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 544 ms. The bar chart above shows every period we have measured.

How do I connect MCP Trust & Tool-Poisoning Audit?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.

How do you sign in to MCP Trust & Tool-Poisoning Audit?

No API key is involved. MCP Trust & Tool-Poisoning Audit answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.

How fast is MCP Trust & Tool-Poisoning Audit?

It answers our handshake in 544 ms on average, which is faster than 22% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is MCP Trust & Tool-Poisoning Audit open source?

The code is open source: it is published under the MIT licence, written in JavaScript and 0 stars on GitHub. The licence covers the code in the repository, not the hosted service at mcp-trust-audit-mcp.mcpize.run, which runs on its operator's own terms.