MCP Server Trust Scoring Tool Released
BaseMac · reddit · 2026-07-15
The author developed a tool called mcp-trustcard, inspired by "npm audit," to provide trust scoring for MCP servers.\n\nChecks Performed\nThe tool runs 8 checks:\n- Installation success\n- Protocol handshake\n- Tool schema validity\n- Presence of dangerous/destructive tools\n- Authentication status\n- Secret leakage\n- Protocol version\n- Latency\n\nResults\nThe author scanned 10 well-known MCP servers, testing them exactly as a real agent would invoke them (npx -y, without arguments/env variables). Results show:\n- 4 out of 10 failed the handshake and timed out because they required additional env/args that clients couldn't discover beforehand\n- server-github is still stuck on an older protocol version\n\nGoals\nThis tool is currently a single-probe, heuristic v1. Its core objective is to establish a public ranking rather than achieve full coverage. The author also suggests adding a mcp.health metadata field to the registry, allowing clients to view the trust card before connecting.
Related event: mcp-trustcard: Security Scoring Tool for MCP Servers(2 posts)→
More from coding & agent
- Dev builds talk on guardrails workflow for shipping AI-written code without reading it — TejasKumar_ · 2026-09-11
- banteg: Codex auto-review has regressed, blocking steps needed to complete authorized tasks — banteg · 2026-09-11
- A doc-anchored agent workflow: you write, the agent only critiques and finds disagreements — lucasmeijer · 2026-09-11
- SymKit MCP: 44 tools for AI agents to verify symbolic derivations — Foreign-Specific-604 · 2026-09-11
- GitHub Copilot team routes user bug reports to an AI agent via Slack — marlene_zw · 2026-09-11
- Scanning 23 agent sessions, a dev found 3 silent failure modes in memory systems — No_Advertising2536 · 2026-09-11