trustmcp: Pre-install Security Scanner for MCP Servers

Description and use

trustmcp is a pre-install security scanner for MCP servers. It analyzes packages before installation to detect vulnerabilities like missing authentication or hardcoded secrets. The tool was refined to handle non-Python packages correctly and avoid false positives.

Problem

A significant portion of public MCP servers lack authentication, and existing scanners typically require the code to be already downloaded and executed, posing security risks before verification.

Outcome

trustmcp allows developers to scan MCP servers for security vulnerabilities before installation. It addresses a critical gap in the MCP ecosystem where most servers lack authentication. The tool was refined to avoid false positives on non-Python packages and normal dependency ranges, providing a more accurate security grade.

Workflow

• Install the tool via pip: pip install trustmcp
• Run a pre-install check on a package (npm, pypi, or github) without executing it: trustmcp check npm:@modelcontextprotocol/server-everything
• The tool resolves the package, downloads it to an isolated temp directory, and performs static analysis.
• Review the output for an A-F grade and SARIF report.
• For local projects, run static analysis: trustmcp scan --path . --mode static

Evidence

Depending on which audit you read, somewhere between 38% and 46% of public MCP servers have no authentication at all.

Source

Currently 3/10 canonical challenges fully detected, 1 partial, 6 missed.

Source

Same server now scores 76, Grade C, which is the actually defensible number

Source