NestDaddy

TrustScan

io.github.entradox/trust-scan · v0.1.0

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

Connect Remote server

Terminal
claude mcp add --transport http trust-scan https://trust-scan-production.up.railway.app/mcp/
~/.cursor/mcp.json
{
  "mcpServers": {
    "trust-scan": {
      "url": "https://trust-scan-production.up.railway.app/mcp/"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "trust-scan": {
      "type": "http",
      "url": "https://trust-scan-production.up.railway.app/mcp/"
    }
  }
}
Claude Desktop
Settings > Connectors > Add custom connector
URL: https://trust-scan-production.up.railway.app/mcp/

Tools 4 found in our last check

  • trust_scan_server

    Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this…

  • trust_scan_file

    Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.

  • skills_list_tool

    List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

  • read_skill

    Read a product skill file by its skill:// URI.

Details

Endpointhttps://trust-scan-production.up.railway.app/mcp/ (Streamable HTTP)
First published7 Sep 2026
Last updated7 Sep 2026
Registry nameio.github.entradox/trust-scan

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.