trustcard: MCP Server Security and Usability Scanner
Middle_Lecture7302 · reddit · 2026-07-15
A developer has built an MCP server scanning tool called mcp-trustcard, functioning much like npm audit. It runs 8 checks (including installation, protocol handshake, tool schema validity, destructive tools, authentication, secret exposure, protocol version, and latency) and generates a score out of 100.
Core Findings: Testing on 10 popular MCP servers revealed that 4 failed the protocol handshake due to hidden environment variables or parameters undiscoverable by the client. Furthermore, server-github is still using an outdated protocol.
The author also proposed introducing a standard mcp.health metadata field in the registry, allowing clients to read the trust card before connecting and avoiding post-connection debugging.
Related event: mcp-trustcard: Security Scoring Tool for MCP Servers(2 posts)→
More from coding & agent
- TRL adds Score Centering, a simple fix for RLHF training instability — lvwerra · 2026-10-27
- Precompute golden answers and match at runtime for exact wording control — colinmcnamara · 2026-10-27
- Dev argues there's still alpha in working with your coding agent interactively — alex_frantic · 2026-10-27
- Researchers launch AMA on patterns for safer AI agents used by citizen developers — Loose_Rip359 · 2026-10-27
- Gradio Adds In-Chat Human-in-the-Loop So ML Intern Pauses Before Training — Gradio · 2026-10-27
- Building Halo Infinite Forge maps with local LLMs, DCjson and Blender MCP — swagonflyyyy · 2026-10-27