tooltrust-directory

README

🛡️ ToolTrust Directory

This repo hosts tooltrust.dev — the website and pre-scanned report data. If you want to scan your own MCP servers, go to tooltrust-scanner.

A public registry of AI agent tools, continuously scanned for prompt injection, data exfiltration, and privilege escalation by ToolTrust Scanner.

🚨 Supply-Chain Incident Coverage (March 2026) ToolTrust now detects and blocks confirmed supply-chain incidents including the LiteLLM / TeamPCP compromise and the malicious axios npm publish (axios@1.14.1, axios@0.30.4). For npm-backed MCP servers, ToolTrust also scores dependency visibility, transitive lockfile evidence, lifecycle scripts, and IOC indicators such as plain-crypto-js.

---

📊 Security Registry

Top 50 by popularity. View all 1857 tools → Full Directory · data/reports/ · docs/tools/

Tool	Version	Popularity	Grade	Key Findings	Scanned
typescript-sdk	2.0.0-beta.1	204.0M/mo	A	AS-014	Sep 4
playwright-mcp	0.0.80	24.4M/mo	C	AS-012, 🔑 AS-002 ×6, AS-014 ×6, ⚡ AS-011 ×5, ⚡ AS-006	Sep 4
ext-apps	1.7.5	12.8M/mo	A	🔑 AS-002, AS-014 ×3	Sep 4
chrome-devtools-mcp	chrome-dev…	10.0M/mo	C	AS-014 ×29, 🔑 AS-002 ×13, ⚡ AS-011 ×4, ⚡ AS-006	Sep 3
context7	1.0.30	4.0M/mo	A	AS-014 ×2, 🔑 AS-002, ⚡ AS-011	Sep 4
upstash-context7-mcp	1.0.30	3.4M/mo	A	AS-014 ×2, 🔑 AS-002, ⚡ AS-011	Jul 17
editor	1.0.0-beta.1	1.7M/mo	A	🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×5	Sep 4
cloudflare-containers	0.3.2	1.6M/mo	A	🔑 AS-002 ×5, ⚡ AS-011, AS-014 ×7	Jun 22
gemini-cli	0.60.0-nig…	1.6M/mo	A	AS-014 ×56, 🔑 AS-002 ×23, ⚡ AS-011 ×11	Sep 4
notion-mcp-server	2.5.0	713.0k/mo	B	AS-012, 🔑 AS-002 ×15, ⚡ AS-011 ×11, AS-014 ×14	Sep 4
xcodebuildmcp	2.7.0	654.2k/mo	A	AS-014 ×71, 🔑 AS-002 ×31, ⚡ AS-011 ×3	Sep 4
n8n-mcp	2.82.1	580.7k/mo	A	AS-014 ×23, 🔑 AS-002 ×8, ⚡ AS-011 ×4	Sep 4
agent-device	0.20.10	545.2k/mo	A	AS-014	Sep 4
mcp-server-github	typescript…	494.7k/mo	B	AS-012, 🔑 AS-002 ×52, ⚡ AS-011 ×36, AS-014 ×86, 📐 AS-003, 🗝️ AS-010	Sep 4
mcp-server-sequential-thinking	typescript…	484.4k/mo	B	AS-012, 🔑 AS-002, ⚡ AS-011, AS-014	Sep 4
cameroncooke-xcodebuildmcp	2.3.2	468.8k/mo	A	AS-014 ×71, 🔑 AS-002 ×31, ⚡ AS-011 ×3	Jun 22
azure-devops-mcp	2.9.0	467.2k/mo	A	AS-014 ×9, 🔑 AS-002, ⚡ AS-011	Aug 28
firecrawl-mcp-server	3.24.1	455.7k/mo	B	AS-012, 🔑 AS-002 ×10, AS-014 ×8, ⚡ AS-011 ×7	Sep 4
figma-context-mcp	0.13.2	335.7k/mo	A	AS-014 ×9, 🔑 AS-002, ⚡ AS-011	Sep 4
qwen-code	weaken-too…	296.3k/mo	A	AS-014 ×28, 🔑 AS-002, ⚡ AS-011	Sep 4
mcp-framework	mcp-framew…	248.4k/mo	A	AS-014 ×3, 🔑 AS-002 ×2, ⚡ AS-011	Aug 10
mcpb	2.1.2	246.9k/mo	C	🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×10, ⚡ AS-006	Sep 4
desktopcommandermcp	0.2.48	231.3k/mo	B	🔑 AS-002 ×19, AS-014 ×26, ⚡ AS-011 ×8, 📐 AS-003	Sep 4
tavily-ai-tavily-mcp	0.2.19	178.6k/mo	A	🔑 AS-002 ×7, ⚡ AS-011 ×5, AS-014 ×5	Jun 22
ms-365-mcp-server	0.149.1	169.8k/mo	A	🔑 AS-002 ×18, AS-014 ×24, ⚡ AS-011 ×14	Sep 4
magic-mcp	0.2.2	155.8k/mo	A	AS-014 ×43, 🔑 AS-002 ×42, ⚡ AS-011 ×36, ⚡ AS-006	Sep 4
mcp-server-circleci	0.20.0	144.0k/mo	B	AS-012, AS-014 ×22, 🔑 AS-002 ×14, ⚡ AS-011 ×12, 📐 AS-003 ×2	Sep 4
n8n-nodes-mcp	0.1.37	132.1k/mo	A	AS-014 ×27, 🔑 AS-002 ×21, ⚡ AS-011 ×9, 🗝️ AS-010	Sep 4
circleci-public-mcp-server-circleci	0.15.1	126.3k/mo	B	🔑 AS-002 ×15, ⚡ AS-011 ×11, AS-014 ×16, 📐 AS-003 ×2	Jun 22
mcp-server-trello	2.0.0-beta.0	123.3k/mo	A	🔑 AS-002 ×106, AS-014 ×200, ⚡ AS-011 ×53, 🗝️ AS-010	Aug 12
apify-mcp-server	0.15.4	121.7k/mo	C	🔑 AS-002 ×16, ⚡ AS-011 ×7, AS-014 ×16, ⚡ AS-006 ×2	Sep 4
exa-mcp-server	3.4.1	120.2k/mo	A	🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2	Sep 4
tavily-mcp	0.2.22	117.7k/mo	B	AS-012, 🔑 AS-002 ×8, ⚡ AS-011 ×5, AS-014 ×6, 🗝️ AS-010	Sep 4
mobile-mcp	1.0.2	97.3k/mo	B	AS-012, AS-014 ×25, 🔑 AS-002 ×7, ⚡ AS-011 ×6	Sep 4
mcp-server-brave-search	typescript…	92.9k/mo	A	🔑 AS-002 ×10, ⚡ AS-011 ×7, AS-014 ×8, 🗝️ AS-010 ×2	Sep 4
mcp-searxng	2.1.0	92.1k/mo	A	🔑 AS-002 ×4, ⚡ AS-011 ×3, AS-014 ×4	Sep 3
mcp-server-time	typescript…	90.1k	A	AS-014 ×2	Sep 4
brave-search-mcp-server	2.1.3	87.8k/mo	A	🔑 AS-002 ×10, ⚡ AS-011 ×7, AS-014 ×8, 🗝️ AS-010 ×2	Sep 4
worldmonitor	2.10.0	85.5k	A	🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2	Sep 4
claude-task-master	0.20.0	80.0k/mo	A	🔑 AS-002 ×23, AS-014 ×57, ⚡ AS-011 ×8, 🗝️ AS-010	Sep 4
mcp-playwright	1.0.12	78.5k/mo	C	🔑 AS-002 ×6, AS-014 ×6, ⚡ AS-011 ×5, ⚡ AS-006	Sep 4
agent-reach	1.5.0	77.8k	A	🔑 AS-002, ⚡ AS-011, AS-014 ×5, 🗝️ AS-010	Sep 4
ruflo	3.38.21	75.4k/mo	A	🔑 AS-002 ×21, ⚡ AS-011 ×18, AS-014 ×27	Sep 4
headroom	0.37.0	68.8k	A	🔑 AS-002 ×2, ⚡ AS-011 ×2, AS-014 ×2	Sep 4
figma-console-mcp	1.40.0	62.5k/mo	B	AS-012, AS-014 ×9, 🔑 AS-002, ⚡ AS-011	Sep 4
mcp-server-typescript	3.1.1	60.2k/mo	B	AS-012, 🔑 AS-002 ×4, ⚡ AS-011 ×4, AS-014 ×4	Sep 4
mempalace	3.9.0	58.8k	A	AS-014 ×3, 🔑 AS-002 ×2, ⚡ AS-011	Sep 4
mcp-server-mysql	2.0.9	56.4k/mo	A	🔑 AS-002 ×4, AS-014 ×4, ⚡ AS-011	Sep 4
ai-engineering-from-scratch	2026.08	52.3k	A	AS-014 ×5, 🔑 AS-002, ⚡ AS-011	Sep 4
mcp-server-kubernetes	4.1.6	51.6k/mo	A	AS-014 ×22, 🔑 AS-002 ×6, ⚡ AS-011 ×3	Sep 4

---

⚖️ Grading System

Grade	Gateway Action	Description
S 🌟	ALLOW	Reserved for dynamic analysis
A	ALLOW	Minimal risk. Safe for production agents.
B	ALLOW + rate limit	Low risk. Minor issues, but generally safe.
C	REQUIRE_APPROVAL	Moderate risk. Remediation recommended.
D	REQUIRE_APPROVAL	High risk. Use only in isolated environments.
F	BLOCK	Critical risk. Do not use in agentic pipelines.

Full methodology: docs/methodology.md

---

🔍 Check Catalog

ToolTrust Scanner check IDs referenced in all reports:

ID	Severity	Detects
🛡️ AS‑001	Critical	Tool Poisoning — Adversarial prompts hidden in tool descriptions (ignore previous instructions, <INST>)
🔑 AS‑002	High/Low	Permission Surface — exec, network, db, fs beyond stated purpose; over-broad input schema
📐 AS‑003	High	Scope Mismatch — Tool name contradicts its permissions (e.g. read_config with exec)
📦 AS‑004	High/Critical	Supply Chain CVEs — Known CVEs in bundled dependencies via OSV
🔓 AS‑005	High	Privilege Escalation — admin/:write OAuth scopes; sudo/impersonate in descriptions
⚡ AS‑006	Critical	Arbitrary Code Execution — evaluate_script, _evaluate suffix, execute javascript, page.evaluate() patterns
ℹ️ AS‑007	Info	Insufficient Tool Data — Tool lacks a valid description or schema
🚨 AS‑008	Critical	Known Compromised Package — Offline embedded blacklist of confirmed supply-chain attacks (LiteLLM 1.82.7/1.82.8, Trivy v0.69.4-v0.69.6, Langflow <1.9.0, Axios 1.14.1/0.30.4). Zero-latency, no network required.
🔤 AS‑009	Medium	Typosquatting — Tool name within edit-distance 2 of a well-known MCP tool, suggesting impersonation
🗝️ AS‑010	Medium	Secret Handling — Input params accepting API keys/passwords; credentials logged insecurely
⚡ AS‑011	Low	DoS Resilience — No rate-limit, timeout, or retry config on network/exec tools
🔄 AS‑012	High	Rug-Pull — Tool set changed between scans of the same version without a version bump (directory pipeline only)
👥 AS‑013	High/Medium	Tool Shadowing — Duplicate or near-duplicate tool name hijacks calls intended for a trusted tool
ℹ️ AS‑014	Info	Dependency Inventory Unavailable — MCP server exposed neither metadata.dependencies nor a repo_url, so supply-chain coverage is limited and must be treated as incomplete
⚠️ AS‑015	Medium/High	Suspicious NPM Lifecycle Script — npm dependency publishes preinstall / postinstall / similar install-time scripts; severity rises for remote-fetch or inline-execution patterns
🚨 AS‑016	Critical	Suspicious NPM IOC Dependency — published npm metadata or install-time scripts reference a known malicious IOC package, domain, URL, or reviewed script pattern such as plain-crypto-js, even if the top-level package name is new
⚠️ AS‑017	Medium	Suspicious Data Exfiltration Description — tool description explicitly suggests sending user data, content, or conversation history to external / remote endpoints, without classifying it as prompt injection
ℹ️ AS‑018	Info	Embedded MCP Server Detected — source-level MCP SDK usage was found, but tools could not be enumerated from a manifest or live handshake, so manual review is still required
🔓 AS‑019	High	Unauthenticated MCP Route Exposure — embedded MCP HTTP routes expose the same handler without equivalent authentication middleware

Full details → docs/methodology.md

---

🤖 AI Agent Integration

Let your AI agent scan its own tools. Add ToolTrust as an MCP server in your .mcp.json or claude_desktop_config.json:

{
  "mcpServers": {
    "tooltrust": {
      "command": "npx",
      "args": ["-y", "tooltrust-mcp"]
    }
  }
}

This gives your agent five security tools:

Tool	Description
tooltrust_scan_config	Scan all MCP servers in your .mcp.json or ~/.claude.json in parallel
tooltrust_scan_server	Launch and scan a specific MCP server
tooltrust_scanner_scan	Scan a JSON blob of tool definitions
tooltrust_lookup	Look up a server's trust grade from this directory
tooltrust_list_rules	List all security rules with IDs and descriptions

Claude Code users: ask your agent to run tooltrust_scan_config to audit every MCP server in your project in one shot.

---

🤝 Contribute

Request a scan — open an issue with the tool's public URL and version.

Dispute a finding — open an issue referencing the finding ID (e.g. AS-002).

Integrate ToolTrust Scanner — see docs/dev.md for the data pipeline and schema spec.

---

📛 Add to your README

If your MCP server was audited and earned a grade, add our badge to your repo:

Grade A (recommended) — copy this into your README:

[![ToolTrust Grade A](https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-directory/main/docs/badges/grade-a.svg)](https://github.com/AgentSafe-AI/tooltrust-directory)

Other grades — replace grade-a with grade-s, grade-b, grade-c, grade-d, or grade-f:

Grade	Badge
S
A
B
C
D
F

Badges link to this directory. Generate SVGs locally: go run ./cmd/badge

---

⚙️ Automation

The registry table above is kept up to date by a daily GitHub Actions workflow:

.github/workflows/daily-audit.yml   ← cron 00:00 UTC + manual dispatch

Each run:

1. Discovers popular MCP servers via GitHub Search (50+ stars) plus Smithery-native servers (10+ uses)
2. Scans new/updated tools with ToolTrust Scanner + OSV supply-chain analysis
3. Publishes updated reports to data/reports/ and regenerates this README

---

Licensed MIT. Scanner engine: ToolTrust Scanner.