io.github.entradox/trust-scan

TrustScan

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

0.1.0
Version
remote
Transport
4
Tools

Security review

Review passed

Reviewed 23h ago.

  • tools: 4 tools scanned
  • metadata: scanned

No findings.

Tools (4)

  • trust_scan_server

    Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.

  • trust_scan_file

    Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.

  • skills_list_tool

    List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

  • read_skill

    Read a product skill file by its skill:// URI.