TrustScan

io.github.entradox/trust-scanVersion 0.1.0

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

Status

Responds273 msNov 14, 2026, 14:50 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:50 UTC
Latency: 273 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://trust-scan-production.up.railway.app/mcp/Responds273 msNov 14, 2026, 14:50 UTC

No sign-in

Claude Code

claude mcp add --transport http trust-scan https://trust-scan-production.up.railway.app/mcp/

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: trust-scan
Remote MCP server URL: https://trust-scan-production.up.railway.app/mcp/

Cursor

{
  "mcpServers": {
    "trust-scan": {
      "url": "https://trust-scan-production.up.railway.app/mcp/"
    }
  }
}

VS Code

code --add-mcp '{"name":"trust-scan","type":"http","url":"https://trust-scan-production.up.railway.app/mcp/"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

4 tools

Tools of TrustScan
	Description		Read-only	Idempotent	Open world
`read_skill`Read a product skill file by its skill:// URI.	Read a product skill file by its skill:// URI.	Not declared	Not declared	Not declared	Not declared
`skills_list_tool`List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.	List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.	Not declared	Not declared	Not declared	Not declared
`trust_scan_file`Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.	Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never modified.	No	Yes	Yes	Not declared
`trust_scan_server`Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.	Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package names — and returns a 0-100 score, letter grade, and detailed findings. Run this on any directory BEFORE wiring it into your agent. Read-only: never modifies the scanned target.	No	Yes	Yes	Not declared

Details

Registry status: Active
Published: Sep 7, 2026
Updated: Sep 7, 2026
Website: https://github.com/entradox/trust-scan⁠ (opens in a new tab)
Repository: https://github.com/entradox/trust-scan⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing