trustmcp: Pre-install Security Scanner for MCP Servers

Описание и применение

trustmcp — это инструмент для предварительного сканирования безопасности серверов MCP. Он анализирует пакеты до их установки, выявляя уязвимости, такие как отсутствие аутентификации или скрытые секреты. Инструмент был улучшен для корректной работы с не-Python пакетами и избежания ложных срабатываний.

Задача

A significant portion of public MCP servers lack authentication, and existing scanners typically require the code to be already downloaded and executed, posing security risks before verification.

Результат

trustmcp allows developers to scan MCP servers for security vulnerabilities before installation. It addresses a critical gap in the MCP ecosystem where most servers lack authentication. The tool was refined to avoid false positives on non-Python packages and normal dependency ranges, providing a more accurate security grade.

Рабочий процесс

• Install the tool via pip: pip install trustmcp
• Run a pre-install check on a package (npm, pypi, or github) without executing it: trustmcp check npm:@modelcontextprotocol/server-everything
• The tool resolves the package, downloads it to an isolated temp directory, and performs static analysis.
• Review the output for an A-F grade and SARIF report.
• For local projects, run static analysis: trustmcp scan --path . --mode static

Доказательства

Depending on which audit you read, somewhere between 38% and 46% of public MCP servers have no authentication at all.

Источник

Currently 3/10 canonical challenges fully detected, 1 partial, 6 missed.

Источник

Same server now scores 76, Grade C, which is the actually defensible number

Источник