AgentGraph Trust
Scan and verify trust for MCP servers, skills, and agent tools before you add them to Claude Code or Cursor.
Overview
AgentGraph Trust is a MCP server for the Ship phase that performs security scanning and trust verification on AI agent tools.
What is this MCP server?
- Security scanning and trust verification focused on AI agent tools
- Published as AgentGraph Trust MCP server v0.3.0 on PyPI (agentgraph-trust)
- Stdio transport for integration with MCP-capable coding agents
- Helps reduce supply-chain risk from unvetted skills and servers
- From agentgraph-co with MCP schema 2025-12-11 metadata
- MCP server version 0.3.0
- Product title: AgentGraph Trust
- Transport: stdio
What problem does it solve?
You cannot easily tell if a new MCP server or agent skill is safe before it runs with access to your repo and environment.
Who is it for?
Solo builders curating skills and MCP servers from the open ecosystem who want a dedicated agent-tool trust scan.
Skip if: Teams with mandated enterprise SCA/SAST pipelines that already gate every dependency with legal and infra sign-off.
What do I get? / Deliverables
You run trust and security checks through MCP before installing third-party agent tooling.
- Trust and security assessment outputs for agent tools via MCP
- Clearer install/no-install decisions for third-party skills and servers
- Reduced blind trust when expanding agent capability surface
Recommended MCP Servers
Journey fit
How it compares
Agent-tool trust MCP scanner, not a runtime WAF or a generic dependency-only npm audit skill.
Common Questions / FAQ
Who is agentgraph-trust for?
Indie developers and agent power users evaluating MCP servers and skills before adding them to local agent configs.
When should I use agentgraph-trust?
Use it during ship/security review whenever you install or update third-party agent tools from GitHub, registries, or marketplaces.
How do I add agentgraph-trust to my agent?
Install the PyPI package agentgraph-trust, register it as a stdio MCP server in Claude Code or Cursor, and invoke trust verification tools on candidates before install.