tooltrust-directory

module
v0.0.0-...-7307766 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: MIT

README

🛡️ ToolTrust Directory

This repo hosts tooltrust.dev — the website and pre-scanned report data. If you want to scan your own MCP servers, go to tooltrust-scanner.

A public registry of AI agent tools, continuously scanned for prompt injection, data exfiltration, and privilege escalation by ToolTrust Scanner.

🚨 Supply-Chain Incident Coverage (March 2026) ToolTrust now detects and blocks confirmed supply-chain incidents including the LiteLLM / TeamPCP compromise and the malicious axios npm publish (axios@1.14.1, axios@0.30.4). For npm-backed MCP servers, ToolTrust also scores dependency visibility, transitive lockfile evidence, lifecycle scripts, and IOC indicators such as plain-crypto-js.

ToolTrust Directory UI

Tools Audited Last Scan Schema

📊 Security Registry

Top 50 by popularity. View all 1878 tools → Full Directory · data/reports/ · docs/tools/

Tool Version Popularity Grade Key Findings Scanned
typescript-sdk 2.3.1 266.7M/mo A AS-014 Oct 13
playwright-mcp 0.0.83 30.5M/mo C AS-014 ×25, 🔑 AS-002 ×12, ⚡ AS-006 ×2, ⚡ AS-011 ×5 Oct 13
ext-apps 2.0.3 19.3M/mo A 🔑 AS-002, AS-014 ×3 Oct 13
chrome-devtools-mcp chrome-dev… 7.5M/mo C AS-014 ×30, 🔑 AS-002 ×13, ⚡ AS-011 ×4, ⚡ AS-006 Oct 13
upstash-context7-mcp 1.0.30 3.4M/mo A AS-014 ×2, 🔑 AS-002, ⚡ AS-011 Jul 17
context7 1.0.30 2.9M/mo A AS-014 ×2, 🔑 AS-002, ⚡ AS-011 Oct 13
mcp-server-filesystem 1.0.0 2.5M/mo A 🔑 AS-002 ×12, AS-014 ×12 Oct 13
gemini-cli 0.65.0-nig… 1.7M/mo A AS-014 ×56, 🔑 AS-002 ×23, ⚡ AS-011 ×11 Oct 13
editor 1.0.3 1.7M/mo A AS-014 ×49, 🔑 AS-002 ×13, ⚡ AS-011 Oct 13
cloudflare-containers 0.3.2 1.6M/mo A 🔑 AS-002 ×5, ⚡ AS-011, AS-014 ×7 Jun 22
agent-device w4-find-wi… 979.6k/mo A AS-014 Oct 13
desktopcommandermcp 0.2.52 926.8k/mo B 🔑 AS-002 ×19, AS-014 ×26, ⚡ AS-011 ×8, 📐 AS-003 Oct 13
notion-mcp-server 2.5.2 771.3k/mo A 🔑 AS-002 ×24, ⚡ AS-011 ×24, AS-014 ×24 Oct 13
mcp-server-sequential-thinking 1.0.0 567.6k/mo A 🔑 AS-002 ×12, AS-014 ×12 Oct 13
firecrawl-mcp-server 3.24.1 551.8k/mo A 🔑 AS-002 ×31, AS-014 ×26, ⚡ AS-011 ×24, 🗝️ AS-010 Oct 13
mcp-server-github 1.0.0 501.2k/mo A 🔑 AS-002 ×12, AS-014 ×12 Oct 13
cameroncooke-xcodebuildmcp 2.3.2 468.8k/mo A AS-014 ×71, 🔑 AS-002 ×31, ⚡ AS-011 ×3 Jun 22
azure-devops-mcp 2.9.0 467.2k/mo A AS-014 ×9, 🔑 AS-002, ⚡ AS-011 Aug 28
xcodebuildmcp 2.7.0 381.1k/mo A AS-014 ×71, 🔑 AS-002 ×31, ⚡ AS-011 ×3 Sep 23
n8n-mcp 2.92.1 379.6k/mo A AS-014 ×23, 🔑 AS-002 ×8, ⚡ AS-011 ×4 Oct 13
qwen-code weaken-too… 331.6k/mo A AS-014 ×30, 🔑 AS-002 ×2, ⚡ AS-011 ×2 Oct 13
mcpb 2.1.2 246.9k/mo C 🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×10, ⚡ AS-006 Sep 4
mcp-framework mcp-framew… 243.6k/mo B 🔑 AS-002 ×9, ⚡ AS-011 ×9, AS-014 ×10, 📐 AS-003 ×2 Oct 13
ms-365-mcp-server 0.162.0 227.2k/mo B AS-012, 🔑 AS-002 ×18, AS-014 ×24, ⚡ AS-011 ×14 Oct 13
mobile-mcp 1.0.10 221.2k/mo A AS-014 ×34, 🔑 AS-002 ×13, ⚡ AS-011 ×7 Oct 13
tavily-ai-tavily-mcp 0.2.19 178.6k/mo A 🔑 AS-002 ×7, ⚡ AS-011 ×5, AS-014 ×5 Jun 22
exa-mcp-server 3.4.2 176.8k/mo A 🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2 Oct 13
cc-switch 4.0.10 143.4k A 🔑 AS-002 ×10, ⚡ AS-011 ×8, AS-014 ×14 Oct 13
rea rea-agents… 134.1k/mo A 🔑 AS-002 ×8, ⚡ AS-011 ×6, AS-014 ×11 Oct 13
figma-console-mcp 1.40.9 127.3k/mo C AS-014 ×121, 🔑 AS-002 ×78, ⚡ AS-011 ×41, ⚡ AS-006, 🗝️ AS-010 Oct 13
circleci-public-mcp-server-circleci 0.15.1 126.3k/mo B 🔑 AS-002 ×15, ⚡ AS-011 ×11, AS-014 ×16, 📐 AS-003 ×2 Jun 22
mcp-server-trello 2.0.0-beta.0 123.3k/mo A 🔑 AS-002 ×106, AS-014 ×200, ⚡ AS-011 ×53, 🗝️ AS-010 Aug 12
magic-mcp 0.2.3 117.5k/mo A AS-014 ×43, 🔑 AS-002 ×42, ⚡ AS-011 ×36, ⚡ AS-006 Oct 4
n8n-nodes-mcp 0.1.37 115.1k/mo A AS-014 ×27, 🔑 AS-002 ×21, ⚡ AS-011 ×9, 🗝️ AS-010 Oct 12
mcp-server-circleci 0.20.0 112.0k/mo B 🔑 AS-002 ×13, ⚡ AS-011 ×13, AS-014 ×13, 📐 AS-003 ×2 Oct 13
mcp-server-brave-search 1.0.0 110.4k/mo A 🔑 AS-002 ×12, AS-014 ×12 Oct 13
apify-mcp-server 0.17.4 106.6k/mo C 🔑 AS-002 ×16, ⚡ AS-011 ×7, AS-014 ×16, ⚡ AS-006 ×2 Oct 13
context-mode 1.0.169 102.1k/mo C AS-012, 🔑 AS-002 ×10, ⚡ AS-006 ×3, AS-014 ×11, ⚡ AS-011 ×6 Oct 13
agent-reach 1.5.0 96.7k A 🔑 AS-002 ×4, ⚡ AS-011 ×4, AS-014 ×9 Oct 13
tavily-mcp 0.2.23 96.2k/mo A 🔑 AS-002 ×7, ⚡ AS-011 ×5, AS-014 ×5 Oct 13
mcp-server-time 1.0.0 91.2k A 🔑 AS-002 ×12, AS-014 ×12 Oct 13
worldmonitor 2.10.0 88.3k A 🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2 Oct 13
ruflo 3.56.9 76.0k/mo A 🔑 AS-002 ×21, ⚡ AS-011 ×18, AS-014 ×27 Oct 13
headroom 0.40.0 75.2k A 🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2 Oct 13
claude-task-master 0.20.0 72.7k/mo A 🔑 AS-002 ×23, AS-014 ×57, ⚡ AS-011 ×8, 🗝️ AS-010 Oct 12
ai-engineering-from-scratch 2026.10.2 68.2k A AS-014 ×5, 🔑 AS-002, ⚡ AS-011 Oct 13
mcp-playwright 1.0.12 63.2k/mo A 🔑 AS-002 ×10, AS-014 ×8, ⚡ AS-011 ×2 Oct 13
mempalace 3.10.0 59.5k A AS-014 ×3, 🔑 AS-002 ×2, ⚡ AS-011 Oct 13
ai-agent-book 1.2 53.8k C 🔑 AS-002 ×16, ⚡ AS-011 ×7, AS-014 ×16, ⚡ AS-006 ×2 Oct 13
ecc 2.2.3 52.0k/mo A 🔑 AS-002 ×8, ⚡ AS-011 ×8, AS-014 ×19 Oct 13

⚖️ Grading System

Grade Gateway Action Description
S 🌟 ALLOW Reserved for dynamic analysis
A ALLOW Minimal risk. Safe for production agents.
B ALLOW + rate limit Low risk. Minor issues, but generally safe.
C REQUIRE_APPROVAL Moderate risk. Remediation recommended.
D REQUIRE_APPROVAL High risk. Use only in isolated environments.
F BLOCK Critical risk. Do not use in agentic pipelines.

Full methodology: docs/methodology.md

🔍 Check Catalog

ToolTrust Scanner check IDs referenced in all reports:

ID Severity Detects
🛡️ AS‑001 Critical Tool Poisoning — Adversarial prompts hidden in tool descriptions (ignore previous instructions, <INST>)
🔑 AS‑002 High/Low Permission Surface — exec, network, db, fs beyond stated purpose; over-broad input schema
📐 AS‑003 High Scope Mismatch — Tool name contradicts its permissions (e.g. read_config with exec)
📦 AS‑004 High/Critical Supply Chain CVEs — Known CVEs in bundled dependencies via OSV
🔓 AS‑005 High Privilege Escalation — admin/:write OAuth scopes; sudo/impersonate in descriptions
⚡ AS‑006 Critical Arbitrary Code Execution — evaluate_script, _evaluate suffix, execute javascript, page.evaluate() patterns
ℹ️ AS‑007 Info Insufficient Tool Data — Tool lacks a valid description or schema
🚨 AS‑008 Critical Known Compromised Package — Offline embedded blacklist of confirmed supply-chain attacks (LiteLLM 1.82.7/1.82.8, Trivy v0.69.4-v0.69.6, Langflow <1.9.0, Axios 1.14.1/0.30.4). Zero-latency, no network required.
🔤 AS‑009 Medium Typosquatting — Tool name within edit-distance 2 of a well-known MCP tool, suggesting impersonation
🗝️ AS‑010 Medium Secret Handling — Input params accepting API keys/passwords; credentials logged insecurely
⚡ AS‑011 Low DoS Resilience — No rate-limit, timeout, or retry config on network/exec tools
🔄 AS‑012 High Rug-Pull — Tool set changed between scans of the same version without a version bump (directory pipeline only)
👥 AS‑013 High/Medium Tool Shadowing — Duplicate or near-duplicate tool name hijacks calls intended for a trusted tool
ℹ️ AS‑014 Info Dependency Inventory Unavailable — MCP server exposed neither metadata.dependencies nor a repo_url, so supply-chain coverage is limited and must be treated as incomplete
⚠️ AS‑015 Medium/High Suspicious NPM Lifecycle Script — npm dependency publishes preinstall / postinstall / similar install-time scripts; severity rises for remote-fetch or inline-execution patterns
🚨 AS‑016 Critical Suspicious NPM IOC Dependency — published npm metadata or install-time scripts reference a known malicious IOC package, domain, URL, or reviewed script pattern such as plain-crypto-js, even if the top-level package name is new
⚠️ AS‑017 Medium Suspicious Data Exfiltration Description — tool description explicitly suggests sending user data, content, or conversation history to external / remote endpoints, without classifying it as prompt injection
ℹ️ AS‑018 Info Embedded MCP Server Detected — source-level MCP SDK usage was found, but tools could not be enumerated from a manifest or live handshake, so manual review is still required
🔓 AS‑019 High Unauthenticated MCP Route Exposure — embedded MCP HTTP routes expose the same handler without equivalent authentication middleware

Full details → docs/methodology.md

🤖 AI Agent Integration

Let your AI agent scan its own tools. Add ToolTrust as an MCP server in your .mcp.json or claude_desktop_config.json:

{
  "mcpServers": {
    "tooltrust": {
      "command": "npx",
      "args": ["-y", "tooltrust-mcp"]
    }
  }
}

This gives your agent five security tools:

Tool Description
tooltrust_scan_config Scan all MCP servers in your .mcp.json or ~/.claude.json in parallel
tooltrust_scan_server Launch and scan a specific MCP server
tooltrust_scanner_scan Scan a JSON blob of tool definitions
tooltrust_lookup Look up a server's trust grade from this directory
tooltrust_list_rules List all security rules with IDs and descriptions

Claude Code users: ask your agent to run tooltrust_scan_config to audit every MCP server in your project in one shot.

🤝 Contribute

Request a scan — open an issue with the tool's public URL and version.

Dispute a finding — open an issue referencing the finding ID (e.g. AS-002).

Integrate ToolTrust Scanner — see docs/dev.md for the data pipeline and schema spec.

📛 Add to your README

If your MCP server was audited and earned a grade, add our badge to your repo:

Grade A (recommended) — copy this into your README:

[![ToolTrust Grade A](https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-directory/main/docs/badges/grade-a.svg)](https://github.com/AgentSafe-AI/tooltrust-directory)

Other grades — replace grade-a with grade-s, grade-b, grade-c, grade-d, or grade-f:

Grade Badge
S Grade S
A Grade A
B Grade B
C Grade C
D Grade D
F Grade F

Badges link to this directory. Generate SVGs locally: go run ./cmd/badge

⚙️ Automation

The registry table above is kept up to date by a daily GitHub Actions workflow:

.github/workflows/daily-audit.yml   ← cron 00:00 UTC + manual dispatch

Each run:

  1. Discovers popular MCP servers via GitHub Search (50+ stars) plus Smithery-native servers (10+ uses)
  2. Scans new/updated tools with ToolTrust Scanner + OSV supply-chain analysis
  3. Publishes updated reports to data/reports/ and regenerates this README

Licensed MIT. Scanner engine: ToolTrust Scanner.

Directories

Path Synopsis
cmd
analyze command
cmd/analyze/main.go
 cmd/analyze/main.go
badge command
cmd/badge/main.go
 cmd/badge/main.go
crawler command
cmd/crawler/main.go
 cmd/crawler/main.go
repo-metadata command
Command repo-metadata enriches directory reports with current GitHub repository health metadata.
 Command repo-metadata enriches directory reports with current GitHub repository health metadata.
smithery-fetch command
cmd/smithery-fetch/main.go
 cmd/smithery-fetch/main.go
sync command
cmd/sync/main.go
 cmd/sync/main.go
transform command
cmd/transform/main.go
 cmd/transform/main.go
pkg
analyzer
pkg/analyzer/osv.go
 pkg/analyzer/osv.go
ossinsight
Package ossinsight fetches OSSInsight's curated "MCP Servers" collection (a high-signal, hand-curated list of canonical MCP server repos) for use as a crawler discovery seed.
 Package ossinsight fetches OSSInsight's curated "MCP Servers" collection (a high-signal, hand-curated list of canonical MCP server repos) for use as a crawler discovery seed.
smithery
pkg/smithery/discovery.go
 pkg/smithery/discovery.go
sync
pkg/sync/github.go
 pkg/sync/github.go

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.