MCP Server Trust Scoring Tool Released
BaseMac · reddit · 2026-07-15
The author developed a tool called mcp-trustcard, inspired by "npm audit," to provide trust scoring for MCP servers.\n\nChecks Performed\nThe tool runs 8 checks:\n- Installation success\n- Protocol handshake\n- Tool schema validity\n- Presence of dangerous/destructive tools\n- Authentication status\n- Secret leakage\n- Protocol version\n- Latency\n\nResults\nThe author scanned 10 well-known MCP servers, testing them exactly as a real agent would invoke them (npx -y, without arguments/env variables). Results show:\n- 4 out of 10 failed the handshake and timed out because they required additional env/args that clients couldn't discover beforehand\n- server-github is still stuck on an older protocol version\n\nGoals\nThis tool is currently a single-probe, heuristic v1. Its core objective is to establish a public ranking rather than achieve full coverage. The author also suggests adding a mcp.health metadata field to the registry, allowing clients to view the trust card before connecting.
Related event: mcp-trustcard: Security Scoring Tool for MCP Servers(2 posts)→
More from coding & agent
- Harness engineering is emerging as the execution layer for reliable AI agents — Pavan_Belagatti · 2026-07-21
- DevFest Lisbon keynote will cover Google AI Studio’s latest vibe coding and agentic AI features — gerardsans · 2026-07-21
- Daniel Hanchen’s 2-hour workshop covers open models, reward hacking and RL — danielhanchen · 2026-07-21
- A Codex joke turns into a recursive debate about Cloud Codex — Dimillian · 2026-07-21
- AI-assisted development is widening security backlogs, so teams should measure risk velocity — WeldPond · 2026-07-21
- Base44 offers $10,000 for AI agent builds on one-command backend — Base44_Sam · 2026-07-21