io.github.entradox/trust-scan

up checked 2026-11-11T05:37:48.247Z

Unclaimed · Unverified

Publisher-provided title

TrustScan

Publisher-provided description

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

Summary by lookupd

Scans MCP server packages and skill files for hidden Unicode injection, dangerous code patterns, and secrets, returning severity-weighted…

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http trust-scan https://trust-scan-production.up.railway.app/mcp/

Codex, remote (streamable-http)

codex mcp add trust-scan --url https://trust-scan-production.up.railway.app/mcp/

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "trust-scan": {
      "url": "https://trust-scan-production.up.railway.app/mcp/"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

trust_scan_server Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006
trust_scan_file Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, l
skills_list_tool List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body wit
read_skill Read a product skill file by its skill:// URI.

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.entradox/trust-scan.svg)](https://lookupd.com/servers/io.github.entradox/trust-scan)