TrustScan
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
| Endpoint | https://trust-scan-production.up.railway.app/mcp/ (streamable-http) |
|---|---|
| Registry version | 0.1.0 |
| Now | 4 tools · grade A (94) · pin ts_133db6b19b2fc0562bac664937064bb3 · protocol 2025-06-18 |
| First / last listed | 2026-10-31 01:59 UTC / 2026-10-31 01:59 UTC |
| Grade over time | 2026-10-31: A (94), 4 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: trust_scan_server trust_scan_file skills_list_tool read_skill
trust_scan_server | Security-scan an MCP server or skill package before trusting it.
Runs all four checks — invisible Unicode prompt-injection, dangerous code
patterns (MCP001–006), hardcoded secrets, typosquat package names — and
returns a 0-100 score, letter grade, and detailed findings. Run this on
any directory BEFORE wiring it into your agent. Read-only: never modifies
the scanned target. params: path*, package_name |
trust_scan_file | Security-scan a single file for invisible Unicode, dangerous patterns, and secrets.
Returns a severity-weighted score and per-finding detail (rule, severity,
location). Read-only: the file is never modified. params: filepath* |
skills_list_tool | List this product's skills. Each entry carries the SKILL.md URI,
its name and description, verbatim frontmatter, and a per-file
sha256 manifest. Read a body with `read_skill`. params: none |
read_skill | Read a product skill file by its skill:// URI. params: uri* |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.