使用说明
🛡️ ToolTrust Directory
This repo hosts tooltrust.dev — the website and pre-scanned report data. If you want to scan your own MCP servers, go to tooltrust-scanner.
A public registry of AI agent tools, continuously scanned for prompt injection, data exfiltration, and privilege escalation by ToolTrust Scanner.
🚨 Supply-Chain Incident Coverage (March 2026) ToolTrust now detects and blocks confirmed supply-chain incidents including the LiteLLM / TeamPCP compromise and the malicious axios npm publish (
axios@1.14.1,axios@0.30.4). For npm-backed MCP servers, ToolTrust also scores dependency visibility, transitive lockfile evidence, lifecycle scripts, and IOC indicators such asplain-crypto-js.
📊 Security Registry
Top 50 by popularity. View all 1952 tools → Full Directory · data/reports/ · docs/tools/
| Tool | Version | Popularity | Grade | Key Findings | Scanned |
|---|---|---|---|---|---|
| typescript-sdk | 2.4.0 |
244.6M/mo | A | AS-014 |
Oct 28 |
| playwright-mcp | 0.0.83 |
24.8M/mo | C | AS-014 ×25, 🔑 AS-002 ×12, ⚡ AS-006 ×2, ⚡ AS-011 ×5 |
Oct 28 |
| ext-apps | 2.0.4 |
18.9M/mo | A | 🔑 AS-002, AS-014 ×3 |
Oct 28 |
| chrome-devtools-mcp | chrome-dev… |
7.3M/mo | C | AS-014 ×32, 🔑 AS-002 ×15, ⚡ AS-011 ×4, ⚡ AS-006 |
Oct 28 |
| cloudflare-containers | 0.3.2 |
6.6M/mo | A | 🔑 AS-002 ×5, ⚡ AS-011, AS-014 ×7 |
Oct 15 |
| context7 | 1.0.30 |
2.5M/mo | A | AS-014 ×2, 🔑 AS-002, ⚡ AS-011 |
Oct 28 |
| upstash-context7-mcp | 1.0.30 |
2.5M/mo | A | AS-014 ×2, 🔑 AS-002, ⚡ AS-011 |
Oct 28 |
| mcp-server-filesystem | 2.1.0 |
2.3M/mo | A | 🔑 AS-002 ×12, AS-014 ×12 |
Oct 28 |
| gemini-cli | 0.67.0-pre… |
1.4M/mo | A | AS-014 ×56, 🔑 AS-002 ×23, ⚡ AS-011 ×11 |
Oct 28 |
| desktopcommandermcp | 0.3.1 |
1.3M/mo | B | 🔑 AS-002 ×19, AS-014 ×25, ⚡ AS-011 ×8, 📐 AS-003 |
Oct 28 |
| editor | 1.0.3 |
1.3M/mo | A | AS-014 ×49, 🔑 AS-002 ×13, ⚡ AS-011 |
Oct 28 |
| agent-device | 0.21.33 |
1.1M/mo | A | AS-014 |
Oct 28 |
| rea | rea-agents… |
954.2k/mo | A | 🔑 AS-002 ×8, ⚡ AS-011 ×6, AS-014 ×11 |
Oct 28 |
| notion-mcp-server | 2.5.2 |
629.2k/mo | A | 🔑 AS-002 ×24, ⚡ AS-011 ×24, AS-014 ×24 |
Oct 28 |
| mcpb | 2.1.2 |
588.5k/mo | C | 🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×10, ⚡ AS-006 |
Oct 15 |
| mcp-server-sequential-thinking | 2.1.0 |
588.1k/mo | A | 🔑 AS-002 ×12, AS-014 ×12 |
Oct 28 |
| firecrawl-mcp-server | 3.24.1 |
548.3k/mo | A | 🔑 AS-002 ×32, AS-014 ×26, ⚡ AS-011 ×24, 🗝️ AS-010 |
Oct 28 |
| gitlab-mcp | 2.3.13 |
513.5k/mo | A | AS-014 ×54, 🔑 AS-002 ×29, ⚡ AS-011 ×15 |
Oct 28 |
| azure-devops-mcp | 2.9.0 |
500.2k/mo | A | AS-014 ×9, 🔑 AS-002, ⚡ AS-011 |
Oct 15 |
| mcp-server-github | 2.1.0 |
428.9k/mo | A | 🔑 AS-002 ×12, AS-014 ×12 |
Oct 28 |
| figma-context-mcp | 0.13.2 |
332.3k/mo | A | AS-014 ×9, 🔑 AS-002, ⚡ AS-011 |
Oct 28 |
| n8n-mcp | 2.99.2 |
321.1k/mo | A | AS-014 ×23, 🔑 AS-002 ×8, ⚡ AS-011 ×4 |
Oct 28 |
| qwen-code | weaken-too… |
288.9k/mo | A | AS-014 ×30, 🔑 AS-002 ×2, ⚡ AS-011 ×2 |
Oct 28 |
| cameroncooke-xcodebuildmcp | 2.3.2 |
271.1k/mo | A | AS-014 ×71, 🔑 AS-002 ×31, ⚡ AS-011 ×3 |
Oct 15 |
| xcodebuildmcp | 2.7.0 |
271.1k/mo | A | AS-014 ×71, 🔑 AS-002 ×31, ⚡ AS-011 ×3 |
Oct 15 |
| n8n-nodes-mcp | 0.1.37 |
229.2k/mo | A | AS-014 ×27, 🔑 AS-002 ×21, ⚡ AS-011 ×9, 🗝️ AS-010 |
Oct 28 |
| mcp-framework | mcp-framew… |
201.6k/mo | B | 🔑 AS-002 ×9, ⚡ AS-011 ×9, AS-014 ×10, 📐 AS-003 ×2 |
Oct 28 |
| ms-365-mcp-server | 0.175.0 |
199.0k/mo | A | AS-014 ×200, 🔑 AS-002 ×237, ⚡ AS-011 ×193, 🗝️ AS-010 ×49 |
Oct 28 |
| mobile-mcp | 1.0.14 |
189.9k/mo | A | AS-014 ×34, 🔑 AS-002 ×13, ⚡ AS-011 ×7 |
Oct 28 |
| chrisdoc-hevy-mcp | 1.23.3 |
157.0k/mo | A | AS-014 ×24, 🔑 AS-002 ×13, ⚡ AS-011 ×4 |
Oct 15 |
| cc-switch | 4.0.21 |
149.5k | A | 🔑 AS-002 ×10, ⚡ AS-011 ×8, AS-014 ×14 |
Oct 28 |
| tacticlaunch-mcp-linear | 1.1.2 |
145.8k/mo | A | AS-014 ×42, 🔑 AS-002 ×14, ⚡ AS-011 ×8 |
Oct 15 |
| browser-use | 0.13.14 |
119.3k | A | 🔑 AS-002 ×3, ⚡ AS-011 ×3, AS-014 ×11 |
Oct 28 |
| magic-mcp | 0.2.3 |
117.5k/mo | A | AS-014 ×43, 🔑 AS-002 ×42, ⚡ AS-011 ×36, ⚡ AS-006 |
Oct 4 |
| circleci-public-mcp-server-circleci | 0.15.1 |
115.2k/mo | B | AS-012, AS-014 ×22, 🔑 AS-002 ×14, ⚡ AS-011 ×12, 📐 AS-003 ×2 |
Oct 15 |
| agent-reach | 1.6.0 |
105.0k | A | 🔑 AS-002 ×4, ⚡ AS-011 ×4, AS-014 ×9 |
Oct 28 |
| tavily-ai-tavily-mcp | 0.2.19 |
96.5k/mo | A | 🔑 AS-002 ×7, ⚡ AS-011 ×5, AS-014 ×5 |
Oct 15 |
| mcp-server-brave-search | 2.1.0 |
91.6k/mo | A | 🔑 AS-002 ×12, AS-014 ×12 |
Oct 28 |
| mcp-server-time | 2.1.0 |
91.6k | A | 🔑 AS-002 ×12, AS-014 ×12 |
Oct 28 |
| servers | typescript… |
91.5k | A | 🔑 AS-002 ×12, AS-014 ×12 |
Oct 15 |
| apify-mcp-server | 0.19.5 |
90.6k/mo | C | 🔑 AS-002 ×16, ⚡ AS-011 ×7, AS-014 ×16, ⚡ AS-006 ×2 |
Oct 28 |
| context-mode | 2.0.0-next.8 |
90.0k/mo | A | 🔑 AS-002 ×7, AS-014 ×7, ⚡ AS-011 |
Oct 28 |
| brave-search-mcp-server | 2.1.4 |
89.8k/mo | A | 🔑 AS-002 ×10, ⚡ AS-011 ×7, AS-014 ×8, 🗝️ AS-010 ×2 |
Oct 28 |
| worldmonitor | 2.11.6 |
89.7k | B | AS-014 ×95, 🔑 AS-002 ×55, ⚡ AS-011 ×49, 📐 AS-003 |
Oct 28 |
| trail-code | 0.21.1 |
88.6k/mo | A | 🔑 AS-002 ×4, ⚡ AS-011 ×4, AS-014 ×5 |
Oct 28 |
| figma-console-mcp | 1.44.2 |
82.9k/mo | C | 🔑 AS-002 ×82, ⚡ AS-011 ×42, AS-014 ×121, ⚡ AS-006 ×2, 🗝️ AS-010 |
Oct 28 |
| netdata | 2.12.2 |
81.2k | A | 🔑 AS-002 ×4, AS-014 ×4, ⚡ AS-011 ×3 |
Oct 28 |
| headroom | 0.42.0 |
78.1k | A | 🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2 |
Oct 28 |
| tavily-mcp | 0.2.23 |
77.8k/mo | A | 🔑 AS-002 ×7, ⚡ AS-011 ×5, AS-014 ×5 |
Oct 28 |
| ai-engineering-from-scratch | 2026.10.4 |
74.7k | A | AS-014 ×5, 🔑 AS-002, ⚡ AS-011 |
Oct 28 |
⚖️ Grading System
| Grade | Gateway Action | Description |
|---|---|---|
| S 🌟 | ALLOW |
Reserved for dynamic analysis |
| A | ALLOW |
Minimal risk. Safe for production agents. |
| B | ALLOW + rate limit |
Low risk. Minor issues, but generally safe. |
| C | REQUIRE_APPROVAL |
Moderate risk. Remediation recommended. |
| D | REQUIRE_APPROVAL |
High risk. Use only in isolated environments. |
| F | BLOCK |
Critical risk. Do not use in agentic pipelines. |
Full methodology: docs/methodology.md
🔍 Check Catalog
ToolTrust Scanner check IDs referenced in all reports:
| ID | Severity | Detects |
|---|---|---|
| 🛡️ AS‑001 | Critical |
Tool Poisoning — Adversarial prompts hidden in tool descriptions (ignore previous instructions, <INST>) |
| 🔑 AS‑002 | High/Low |
Permission Surface — exec, network, db, fs beyond stated purpose; over-broad input schema |
| 📐 AS‑003 | High |
Scope Mismatch — Tool name contradicts its permissions (e.g. read_config with exec) |
| 📦 AS‑004 | High/Critical |
Supply Chain CVEs — Known CVEs in bundled dependencies via OSV |
| 🔓 AS‑005 | High |
Privilege Escalation — admin/:write OAuth scopes; sudo/impersonate in descriptions |
| ⚡ AS‑006 | Critical |
Arbitrary Code Execution — evaluate_script, _evaluate suffix, execute javascript, page.evaluate() patterns |
| ℹ️ AS‑007 | Info |
Insufficient Tool Data — Tool lacks a valid description or schema |
| 🚨 AS‑008 | Critical |
Known Compromised Package — Offline embedded blacklist of confirmed supply-chain attacks (LiteLLM 1.82.7/1.82.8, Trivy v0.69.4-v0.69.6, Langflow <1.9.0, Axios 1.14.1/0.30.4). Zero-latency, no network required. |
| 🔤 AS‑009 | Medium |
Typosquatting — Tool name within edit-distance 2 of a well-known MCP tool, suggesting impersonation |
| 🗝️ AS‑010 | Medium |
Secret Handling — Input params accepting API keys/passwords; credentials logged insecurely |
| ⚡ AS‑011 | Low |
DoS Resilience — No rate-limit, timeout, or retry config on network/exec tools |
| 🔄 AS‑012 | High |
Rug-Pull — Tool set changed between scans of the same version without a version bump (directory pipeline only) |
| 👥 AS‑013 | High/Medium |
Tool Shadowing — Duplicate or near-duplicate tool name hijacks calls intended for a trusted tool |
| ℹ️ AS‑014 | Info |
Dependency Inventory Unavailable — MCP server exposed neither metadata.dependencies nor a repo_url, so supply-chain coverage is limited and must be treated as incomplete |
| ⚠️ AS‑015 | Medium/High |
Suspicious NPM Lifecycle Script — npm dependency publishes preinstall / postinstall / similar install-time scripts; severity rises for remote-fetch or inline-execution patterns |
| 🚨 AS‑016 | Critical |
Suspicious NPM IOC Dependency — published npm metadata or install-time scripts reference a known malicious IOC package, domain, URL, or reviewed script pattern such as plain-crypto-js, even if the top-level package name is new |
| ⚠️ AS‑017 | Medium |
Suspicious Data Exfiltration Description — tool description explicitly suggests sending user data, content, or conversation history to external / remote endpoints, without classifying it as prompt injection |
| ℹ️ AS‑018 | Info |
Embedded MCP Server Detected — source-level MCP SDK usage was found, but tools could not be enumerated from a manifest or live handshake, so manual review is still required |
| 🔓 AS‑019 | High |
Unauthenticated MCP Route Exposure — embedded MCP HTTP routes expose the same handler without equivalent authentication middleware |
Full details → docs/methodology.md
🤖 AI Agent Integration
Let your AI agent scan its own tools. Add ToolTrust as an MCP server in your .mcp.json or claude_desktop_config.json:
{
"mcpServers": {
"tooltrust": {
"command": "npx",
"args": ["-y", "tooltrust-mcp"]
}
}
}
This gives your agent five security tools:
| Tool | Description |
|---|---|
tooltrust_scan_config |
Scan all MCP servers in your .mcp.json or ~/.claude.json in parallel |
tooltrust_scan_server |
Launch and scan a specific MCP server |
tooltrust_scanner_scan |
Scan a JSON blob of tool definitions |
tooltrust_lookup |
Look up a server's trust grade from this directory |
tooltrust_list_rules |
List all security rules with IDs and descriptions |
Claude Code users: ask your agent to run tooltrust_scan_config to audit every MCP server in your project in one shot.
🤝 Contribute
Request a scan — open an issue with the tool's public URL and version.
Dispute a finding — open an issue referencing the finding ID (e.g. AS-002).
Integrate ToolTrust Scanner — see docs/dev.md for the data pipeline and schema spec.
📛 Add to your README
If your MCP server was audited and earned a grade, add our badge to your repo:
Grade A (recommended) — copy this into your README:
[](https://github.com/AgentSafe-AI/tooltrust-directory)
Other grades — replace grade-a with grade-s, grade-b, grade-c, grade-d, or grade-f:
| Grade | Badge |
|---|---|
| S | |
| A | |
| B | |
| C | |
| D | |
| F |
Badges link to this directory. Generate SVGs locally: go run ./cmd/badge
⚙️ Automation
The registry table above is kept up to date by a daily GitHub Actions workflow:
.github/workflows/daily-audit.yml ← cron 00:00 UTC + manual dispatch
Each run:
- Discovers popular MCP servers via GitHub Search (50+ stars) plus Smithery-native servers (10+ uses)
- Scans new/updated tools with ToolTrust Scanner + OSV supply-chain analysis
- Publishes updated reports to
data/reports/and regenerates this README
Licensed MIT. Scanner engine: ToolTrust Scanner.
