TrustScan
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
Community: Submitted by a user or imported; check the owner before granting accessOnlineNo sign-inGlobalFreeRead-only
What it can do
What data it sees
Do you need an account
No: the server works without sign-in
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
Server tool list (4)
Raw names from tools/list. Only developers need these.
| trust_scan_server | Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target. |
| trust_scan_file | Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified. |
| skills_list_tool | List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`. |
| read_skill | Read a product skill file by its skill:// URI. |