Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
Connect Remote server
claude mcp add --transport http trust-scan https://trust-scan-production.up.railway.app/mcp/
{
"mcpServers": {
"trust-scan": {
"url": "https://trust-scan-production.up.railway.app/mcp/"
}
}
}
{
"servers": {
"trust-scan": {
"type": "http",
"url": "https://trust-scan-production.up.railway.app/mcp/"
}
}
}
Settings > Connectors > Add custom connector
URL: https://trust-scan-production.up.railway.app/mcp/
Tools 4 found in our last check
trust_scan_serverSecurity-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this…
trust_scan_fileSecurity-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.
skills_list_toolList this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.
read_skillRead a product skill file by its skill:// URI.
Details
| Endpoint | https://trust-scan-production.up.railway.app/mcp/ (Streamable HTTP) |
| First published | 7 Sep 2026 |
| Last updated | 7 Sep 2026 |
| Registry name | io.github.entradox/trust-scan |
More security servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
