Log inSubmit server
ToolTrust Scanner logo

ToolTrust Scanner

Scans MCP tools for security risks, assigns A–F grades, and maps findings to allow, approval, or block decisions.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install ToolTrust Scanner

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "tooltrust-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "tooltrust-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

ToolTrust Scanner MCP server analyzes MCP tool definitions for prompt injection, excessive permissions, supply-chain risks, data exfiltration indicators, and other security issues. It can read local MCP configuration files, launch servers over stdio, or inspect raw JSON definitions, then assigns risk scores, letter grades, and enforcement decisions. Use it before adding MCP servers to an agent workflow or as part of a local review and CI process. Analysis is static and runs locally, with optional network access for CVE lookups.

Use cases

  • Scan local MCP configurations before enabling servers
  • Review a server command before adding it to an agent
  • Check raw tool definitions during development
  • Inspect trust grades from the ToolTrust Directory
  • List built-in rules for security review

Key features

  • Assigns A–F trust grades and risk scores
  • Detects prompt injection and privilege escalation patterns
  • Scans local MCP configurations and live stdio servers
  • Analyzes raw JSON tool definitions
  • Maps findings to allow, approval, or block decisions
  • Lists built-in security rules

Tools5

What ToolTrust Scanner lets your agent do. Expand a tool for its parameters.

Self-reported~85 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

20/25 checks healthy over the last 90d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 1d ago via OSV.dev · tooltrust-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars19Stargazers on the source repository.
npm downloads205Package downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Tools exposed5Callable tools this server registers over MCP.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How ToolTrust Scanner works

What ToolTrust Scanner MCP server does

ToolTrust Scanner MCP server reviews the definitions exposed by MCP tools before an agent uses them. It examines names, descriptions, input schemas, permissions, dependency metadata, and selected source-level indicators. Findings cover risks such as hidden prompt instructions, scope mismatches, arbitrary code execution patterns, secret handling, suspicious installation scripts, typosquatting, tool shadowing, and possible data exfiltration.

Each tool receives a numeric risk score and an A–F grade. The scanner also maps grades to an enforcement outcome: ALLOW, REQUIRE_APPROVAL, or BLOCK. Its rule set includes static tool-definition checks and source checks for embedded MCP implementations. Tool-drift detection is handled by the separate ToolTrust Directory workflow rather than the local scanner.

How it works

The scanner supports three input paths. A configuration scan reads .mcp.json or ~/.claude.json, starts the configured MCP servers as subprocesses, and examines their tools in parallel. A server scan accepts a command, launches it over stdio, and inspects the resulting tool definitions. A raw scan accepts JSON containing tool definitions without starting a server.

The analysis is deterministic and does not use an LLM. It normally runs in milliseconds, and data remains on the local machine except when optional CVE lookups are enabled. Source checks can identify embedded MCP SDK usage or unauthenticated HTTP route exposure when the relevant source information is available.

Setup and configuration

Run the ToolTrust Scanner MCP server through npx -y tooltrust-mcp, or install the command-line binary with the provided shell installer or go install. An MCP host launches the server as a stdio subprocess, so this setup does not create a network listener.

A typical MCP configuration supplies npx as the command and passes -y tooltrust-mcp as its arguments. The configuration-scan tool then reads the local MCP configuration and starts each configured server. The command-scan tool instead runs a user-provided server command. No required environment variables are documented.

Tools and capabilities

The MCP interface exposes:

  • tooltrust_scan_config: scans servers listed in .mcp.json or ~/.claude.json.
  • tooltrust_scan_server: launches and scans one server command as a subprocess.
  • tooltrust_scanner_scan: analyzes a raw JSON blob of tool definitions.
  • tooltrust_lookup: retrieves a server trust grade from the ToolTrust Directory.
  • tooltrust_list_rules: lists the built-in security rules.

The rule set includes checks for prompt injection, permissions, scope mismatches, known CVEs, privilege escalation, arbitrary code execution, incomplete tool metadata, compromised packages, typosquatting, credentials, denial-of-service configuration, tool shadowing, suspicious npm lifecycle scripts, suspicious npm indicators, and explicit exfiltration descriptions.

Limitations and notes

ToolTrust Scanner MCP server is a static analyzer, not an MCP host, gateway, or runtime proxy. It does not mediate calls after deployment. CVE checks may use the OSV service, while the compromised-package blacklist works offline. The published research cohort is a historical snapshot and should not be treated as a current inventory.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about ToolTrust Scanner

ToolTrust Scanner is an MCP server that connects to local MCP configurations and launched MCP servers, and it can inspect raw JSON tool definitions. Its main tools scan configurations, scan server commands, analyze JSON, look up directory trust grades, and list built-in security rules.

Install it with `npx -y tooltrust-mcp`, the provided macOS/Linux shell installer, or `go install`. For MCP clients, configure `npx` as the command with `-y tooltrust-mcp` as its arguments so the host launches it over stdio.

It can scan `.mcp.json` and `~/.claude.json` through `tooltrust_scan_config`. It can also inspect a specific server command or a raw JSON blob containing tool definitions.

No LLM is used, and analysis runs locally. Optional CVE lookups can access external data through OSV; otherwise the scanner does not send scan data away from the machine.

No. It is a static scanner and does not host, proxy, or mediate MCP calls after deployment. Its enforcement results are reported as `ALLOW`, `REQUIRE_APPROVAL`, or `BLOCK` decisions.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewToolTrust Scanner AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/tooltrust-scanner?style=directory)](https://allmcps.com/mcp/tooltrust-scanner)
HTML Embed
<a href="https://allmcps.com/mcp/tooltrust-scanner"><img src="https://allmcps.com/api/badge/tooltrust-scanner?style=directory" alt="ToolTrust Scanner on AllMCPs" /></a>