trustmcp: Pre-install Security Scanner for MCP Servers

说明与用途

trustmcp 是一个用于 MCP 服务器的安装前安全扫描工具。它在安装前分析包，以检测缺少身份验证或硬编码秘密等漏洞。该工具经过优化，可正确处理非 Python 包并避免误报。

问题

A significant portion of public MCP servers lack authentication, and existing scanners typically require the code to be already downloaded and executed, posing security risks before verification.

结果

trustmcp allows developers to scan MCP servers for security vulnerabilities before installation. It addresses a critical gap in the MCP ecosystem where most servers lack authentication. The tool was refined to avoid false positives on non-Python packages and normal dependency ranges, providing a more accurate security grade.

工作流

• Install the tool via pip: pip install trustmcp
• Run a pre-install check on a package (npm, pypi, or github) without executing it: trustmcp check npm:@modelcontextprotocol/server-everything
• The tool resolves the package, downloads it to an isolated temp directory, and performs static analysis.
• Review the output for an A-F grade and SARIF report.
• For local projects, run static analysis: trustmcp scan --path . --mode static

证据

Depending on which audit you read, somewhere between 38% and 46% of public MCP servers have no authentication at all.

来源

Currently 3/10 canonical challenges fully detected, 1 partial, 6 missed.

来源

Same server now scores 76, Grade C, which is the actually defensible number

来源