TrustScan
https://trust-scan-production.up.railway.app/mcp/ ↗
Description
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
What our measurements say
TrustScan is a remote MCP server published at trust-scan-production.up.railway.app. It has been probed 6 times since 9/12/2026. It answered in 6 of them (100.0%), a near-uninterrupted record. Median response time is 425 ms, placing it among the faster endpoints. It offers a narrow, focused set of 2 tools. On the protocol side it speaks the 2026-07-28 stateless spec.
Agent readability score
Can an LLM agent pick the right tool here — names, descriptions and parameter clarity are assessed.
Agent readability score
Strengths
- Tool names clearly indicate server vs. file scanning scope
- Parameters are well-defined with required/optional status
Weaknesses
- Descriptions contain ambiguous abbreviations (e.g., 'BE' in trust_scan_server)
- Similar security checks create potential tool overlap
- No explicit error handling or constraint documentation
trust_scan_server— Ambiguous 'BE' abbreviation in descriptiontrust_scan_server— Typosquat check mentioned without clear scopetrust_scan_file— No mention of file size limitations or format requirements
Verdict
Event narrative
Risk: low
Advice
Schema compliance
tools/list structure, inputSchema validity, and a functional smoke test — the components of the 0-100 score.
- tools/list schema valid
- inputSchema is valid JSON Schema
- Smoke test not run this round
- Cold-start: cold 177ms → warm 219ms (penalty 0ms)
Tools
Tools the server advertised in the latest measurement — measured, not catalog-claimed.
trust_scan_serverSecurity-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.
pathstringrequiredpackage_namestring
trust_scan_fileSecurity-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.
filepathstringrequired
Availability history
Event log
Derived by comparing consecutive probes — changes in era, protocol version, build and reachability.
- Added to watch — era: Dual-era
Get your badge
Add this badge to your README — it updates automatically as measurements change.
[](https://mcpmetrics.io/servers/io-github-entradox-trust-scan)<a href="https://mcpmetrics.io/servers/io-github-entradox-trust-scan"><img src="https://mcpmetrics.io/badge/io.github.entradox/trust-scan/era.svg" alt="mcpmetrics"></a>You are seeing the last 7 days. Sign up for the full history. Which check failed and why is in the dashboard.
Sign up free to seeSimilar MCP servers
The catalog entries whose name and description are closest to this one, found with the same index the search box uses.
- SkillsSafe Security Scannermcp.skillssafe.com
AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.
- Frogeye Security Scannermcp.frogeye.ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
- Kloudle Cloud Security Scannermcp.kloudle.dev
AWS cloud security scanners for AI agents — S3, IAM, EC2, EKS, RDS, CloudTrail, CloudWatch Logs
- BlackVeil DNS & Email Security Scannerdns-mcp.blackveilsecurity.com
DNS and email security scanner with 79 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
- Compuute MCP Security Scannerscan.compuute.se
Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.
- IntoDNS.ai DNS & Email Security Scannerintodns.ai
DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.
Comments
Sign in to write a comment
No comments yet. Be the first.