ToolTrust Scanner
Scan third-party MCP servers for prompt injection, data exfiltration, and privilege escalation before you add them to your agent stack.
Overview
ToolTrust Scanner is an MCP server for the ship phase that scans MCP servers for prompt injection, data exfiltration, and privilege escalation risks.
What is this MCP server?
- Targets MCP server attack surfaces: prompt injection, exfiltration, privilege escalation
- stdio npm package tooltrust-mcp (v1.0.9) for local agent-driven scans
- Purpose-built for ToolTrust / AgentSafe workflow—not generic npm audit alone
- Fits pre-ship gate before wiring marketplace MCPs into Claude Code
- AgentSafe-AI maintained scanner with GitHub source for updates
- Registry version 1.0.9
- npm identifier tooltrust-mcp with stdio transport
- GitHub repository AgentSafe-AI/tooltrust-scanner
Community signal: 16 GitHub stars.
What problem does it solve?
New MCP servers look convenient in READMEs but can hide injection or exfiltration behavior your agent will execute with full tool access.
Who is it for?
Builders curating a personal MCP allowlist who want automated MCP-centric checks before enabling unknown servers.
Skip if: Teams with zero MCP usage or those who already run a full external AppSec program on every dependency weekly.
What do I get? / Deliverables
You get scanner-driven findings on risky MCP patterns so you can block, sandbox, or fix integrations before production agent sessions.
- Security findings focused on MCP abuse patterns
- Go/no-go signal for adding third-party MCP servers
- Documented risk themes (injection, exfiltration, escalation) for remediation
Recommended MCP Servers
Journey fit
How it compares
MCP-focused security scanner MCP, not a hosted WAF or generic dependency CVE database.
Common Questions / FAQ
Who is ToolTrust Scanner for?
Solo developers and agent authors who install many MCP servers and need injection and exfiltration checks tailored to tool protocols.
When should I use ToolTrust Scanner?
During ship and security review immediately before adding new MCP servers to Claude Code, Cursor, or production agent configs.
How do I add ToolTrust Scanner to my agent?
Install the npm package tooltrust-mcp (stdio transport v1.0.9) and register it as an MCP server in your client, then invoke scan tools against target server configs or packages.