Tooltrust Scanner

ToolTrust Scanner

Static security scanner for MCP tool definitions Trust grades (A–F) before your agent calls a tool — run as an MCP server, CLI, or CI check.

---

Every MCP tool your agent calls is an attack surface — prompt injection, data exfiltration, privilege escalation, supply-chain backdoors. ToolTrust scans tool definitions before your agent trusts them and assigns a trust grade (A–F) so you know the risk. ToolTrust is an MCP Server and a CLI/CI tool — not a host, gateway, or runtime proxy. Coverage is expanding beyond today’s MCP-focused workflows; skills and additional agent tool formats are on the roadmap.

Browse the live ToolTrust Directory — trust grades and scan-backed reports before you install.

MCP demo: run a full config scan from your agent.

Scan your setup in 30 seconds

Add ToolTrust as an MCP server and let your agent audit its own tools (stdio transport — no network listener; your host launches it as a subprocess):

{
  "mcpServers": {
    "tooltrust": {
      "command": "npx",
      "args": ["-y", "tooltrust-mcp"]
    }
  }
}

Then ask your agent: "Run tooltrustscanconfig"

It reads your MCP config, connects to each server in parallel, scans every tool, and returns a risk report with grades and enforcement decisions — all in seconds.

Or use the CLI:

curl -sfL https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-scanner/main/install.sh | bash
tooltrust-scanner scan --server "npx -y @modelcontextprotocol/server-filesystem /tmp"

Example snapshot (research cohort)

The public ToolTrust Directory holds current grades and aggregates as scanning scales. One published research pass illustrates the shape of the problem — 207 MCP servers, 3,235 tools — not an exhaustive count of everything we scan today:

| Metric | Count | |--------|-------| | MCP servers in cohort | 207 | | Individual tools analyzed | 3,235 | | Total security findings | 3,613 | | Servers with at least one finding | 145 (70%) | | Servers with a clean Grade A | 22 (10%) | | Servers with arbitrary code execution | 16 |

Only 10% of servers in that cohort had a clean Grade A. See tooltrust.dev for up-to-date directory-wide results (and use this table only as a labeled snapshot).

🔍 What it catches

ToolTrust runs 16 static tool-definition rules in this repo (AS-001–AS-011, AS-013–AS-017) plus 2 source-scan rules for embedded MCP implementations (AS-018, AS-019). AS-012 (tool drift) is evaluated in the ToolTrust Directory when new scan results are compared to previous runs.

| ID | Severity | Detects | |----|:--------:|---------| | 🛡️ AS‑001 | Critical | Tool Poisoning — Adversarial prompts hidden in tool descriptions (ignore previous instructions, `) | | 🔑 **AS‑002** | High/Low | **Permission Surface** — exec, network, db, fs beyond stated purpose; over-broad input schema | | 📐 **AS‑003** | High | **Scope Mismatch** — Tool name contradicts its permissions (e.g. readconfig with exec) | | 📦 **AS‑004** | High/Critical | **Supply Chain CVEs** — Known CVEs in bundled dependencies via [OSV](https://osv.dev) | | 🔓 **AS‑005** | High | **Privilege Escalation** — admin/:write OAuth scopes; sudo/impersonate in descriptions | | ⚡ **AS‑006** | Critical | **Arbitrary Code Execution** — evaluatescript, _evaluate suffix, execute javascript, page.evaluate() patterns | | ℹ️ **AS‑007** | Info | **Insufficient Tool Data** — Tool lacks a valid description or schema | | 🚨 **AS‑008** | Critical` | Known Compromised Package — Offline embedded blacklist of confirmed supply-chain attacks (LiteLLM 1.82.7/1.82.8, Trivy v0.69.4-v0.69.6, Langflow [](https://www.tooltrust.dev/)

---

> Supply-chain alert: ToolTrust detects and blocks confirmed compromised packages including LiteLLM v1.82.7/8 (TeamPCP backdoor), Trivy v0.69.4–v0.69.6, and Langflow < 1.9.0. If you encounter a Grade F with rule AS-008, remove the package immediately and rotate all credentials.

---

[Usage guide](docs/USAGE.md) · [Developer guide](docs/DEVELOPER.md) · [Contributing](docs/CONTRIBUTING.md) · [Deployment & security](#deployment-and-security) · [Changelog](CHANGELOG.md) · [Security](docs/SECURITY.md) · [License: MIT](LICENSE)

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: AgentSafe-AI
• Source: AgentSafe-AI/tooltrust-scanner
• License: MIT
• Homepage: https://www.tooltrust.dev/

Install and usage instructions live in the source repository linked above.