Which integrations are available for this server?

Allows for scanning GitHub repositories to detect security vulnerabilities, hardcoded secrets, and dependency risks, with capabilities for AI-driven code analysis and automated fix pull request generation. Provides automated security scan alerts and notifications through Slack integration for scheduled scans and security digests.

trust-security

by Jaden-JJH

Overview Schema Related Servers Score Discussions

TypeScript

Remote

Trust - AI-Native Security Scanner

Smithery

Scan websites and GitHub repositories for security vulnerabilities. AI analyzes root causes, generates fix code with before/after diffs, and creates one-click Fix PRs.

Live: https://www.trust-scan.me

Korean / 한국어 문서

Features

URL Security Scan

DAST vulnerability detection with 5,000+ Nuclei templates
Runtime checks for HTTP headers, SSL, CORS, cookie settings, and more
Scan completes in under 30 seconds

GitHub Repo Scan

SAST: Code-level vulnerability detection with Semgrep (XSS, SQL Injection, hardcoded secrets, etc.)
Secrets: API key, token, and password exposure detection with Gitleaks
SCA: Dependency CVE detection with npm audit
Weighted scoring system (A+ to F grade)

AI Analysis (Pro)

Root cause analysis for each vulnerability using Claude Sonnet
Before/After code: Actual fix code diff generation
Step-by-step remediation guide

Auto-Fix PR (Pro)

One-click GitHub PR creation from AI-analyzed vulnerabilities
Automatic branch creation + file modification + PR opening
package.json version update support

Fix with AI (Pro)

Fix prompt generation for all vulnerabilities
Directly applicable in Cursor, Claude Code, and other IDEs

Additional Features

Trust Badge: Security score-based README badge
Benchmark: Compare security scores with other sites
Shared Reports: Share scan result URLs (viewable without login)
MCP Server: In-IDE security scanning for Claude Code and Cursor (8 tools + 3 resources)
GitHub Action: Automated security scanning in CI/CD pipelines + PR comments
Scheduled Scans: Hourly / Daily / Weekly automatic security scans + email/Slack alerts
Weekly Digest: Weekly security report email (score trends, vulnerability summary)
Push Notifications: Web Push notifications on scan completion

Plans

	Free	Pro ($9.9/mo)
URL Scans	5/month	Unlimited
Repo Scans	3/month	Unlimited
AI Analysis	2 per scan	Unlimited
Auto-Fix PR	-	Yes
Scheduled Scans	-	Yes
PDF/CSV Export	-	Yes

Related MCP server: Security MCP Server

MCP Server (Model Context Protocol)

Install with a single command in Claude Code, Cursor IDE, and other MCP clients to get real-time security feedback while coding.

Install (Claude Code)

claude mcp add --transport http trust-security "https://trust-mcp-144011703035.asia-northeast3.run.app/mcp"

Install (Claude Desktop / Cursor)

Add to your config file:

{
  "mcpServers": {
    "trust-security": {
      "type": "http",
      "url": "https://trust-mcp-144011703035.asia-northeast3.run.app/mcp"
    }
  }
}

Available Tools (8 tools)

Tool	Description	Example
`scan_and_wait`	Scan website + wait for results (recommended)	"Scan https://my-app.com"
`scan_url`	Start website scan (async)	"Start a scan"
`get_scan_result`	Get URL scan results	"Show scan results"
`scan_repo_and_wait`	Scan GitHub repo + wait for results (recommended)	"Security scan this repo"
`scan_repo`	Start repo scan (async)	"Start repo scan"
`get_repo_scan_result`	Get repo scan results	"Show repo scan results"
`analyze_code_security`	Analyze code vulnerabilities + secrets (37+ patterns)	"Check this code for security issues"
`check_secrets`	Detect API keys/passwords (20+ patterns)	"Any exposed keys in this code?"

MCP Resources (3 resources)

Context resources automatically read by AI agents.

Resource URI	Description
`trust://scans/latest`	Most recent scan result (score, grade, vulnerability count)
`trust://scans/history`	Last 10 scan history
`trust://security/posture`	Security posture summary (average score, trends, grade distribution)

Tech Stack

Area	Technology
Frontend	Next.js 16, React 19, TailwindCSS 4, Framer Motion
Backend	FastAPI, Python 3.11+, Nuclei, Semgrep, Gitleaks
Database	Supabase (PostgreSQL + Auth + RLS)
AI	Claude API (Anthropic) — Sonnet for analysis
Payment	Paddle (Pro subscription)
Deployment	Vercel (Frontend), Cloud Run (Backend + MCP)

Project Structure

.
├── app/                        # Next.js App Router
│   ├── page.tsx                # Landing (URL / Repo scan)
│   ├── report/[scanId]/        # Scan report page
│   ├── history/                # Scan history
│   ├── pricing/                # Pricing
│   ├── why-trust/              # Why Trust marketing
│   ├── auth/                   # OAuth callbacks (Supabase, GitHub)
│   ├── mcp/                    # MCP setup guide
│   ├── error.tsx               # Error boundary
│   └── not-found.tsx           # 404 page
├── components/
│   ├── trust/                  # Main view components
│   │   ├── client-app.tsx      # Main app state management
│   │   ├── dashboard-view.tsx  # Scan result dashboard
│   │   ├── landing-view.tsx    # Landing view
│   │   ├── scanning-view.tsx   # Scan progress view
│   │   ├── UpgradeModal.tsx    # Go Pro modal
│   │   ├── NotificationToggle.tsx  # Push notification toggle
│   │   ├── OnboardingTour.tsx  # Onboarding tour
│   │   └── dashboard/
│   │       ├── CreateFixPRModal.tsx   # Fix PR modal
│   │       ├── FixPromptModal.tsx     # Fix Prompt modal
│   │       ├── ScheduleSection.tsx    # Scheduled scan management
│   │       ├── DigestSection.tsx      # Weekly digest settings
│   │       ├── BadgeSection.tsx       # Trust Badge
│   │       ├── VulnerabilityList.tsx  # Vulnerability list
│   │       └── ExportPanel.tsx        # PDF/CSV export
│   └── ui/                     # Shared UI (shadcn/ui)
├── lib/
│   ├── api.ts                  # Backend API client
│   ├── types.ts                # TypeScript type definitions
│   ├── supabase.ts             # Supabase client
│   └── subscription.ts         # Pro subscription state management
│
├── backend/                    # FastAPI Backend
│   ├── app/
│   │   ├── main.py             # FastAPI entrypoint
│   │   ├── config.py           # Configuration
│   │   ├── limiter.py          # Rate limiting
│   │   ├── api/routes/
│   │   │   ├── scan.py              # URL scan API
│   │   │   ├── repo_scan.py         # GitHub repo scan API
│   │   │   ├── analyze.py           # AI analysis API
│   │   │   ├── github.py            # GitHub integration + Fix PR API
│   │   │   ├── github_webhook.py    # GitHub webhook handler
│   │   │   ├── badge.py             # Trust Badge API
│   │   │   ├── billing_webhook.py   # Paddle billing webhook
│   │   │   ├── notifications.py     # Notification settings API
│   │   │   └── scheduled_scans.py   # Scheduled scan API
│   │   └── services/
│   │       ├── nuclei_scanner.py
│   │       ├── semgrep_scanner.py
│   │       ├── gitleaks_scanner.py
│   │       ├── repo_scanner.py       # Unified repo scanner
│   │       ├── claude_analyzer.py    # AI analysis (Claude)
│   │       ├── github_service.py     # GitHub API service
│   │       ├── supabase_client.py    # DB service
│   │       ├── scheduler.py          # Scheduled scan scheduler
│   │       └── notifier.py           # Email/Slack/digest notifications
│   ├── Dockerfile
│   └── requirements.txt
│
├── mcp-server/                 # MCP Server (standalone service)
│   ├── server.py
│   ├── Dockerfile
│   └── requirements.txt
│
├── public/
│   └── sw.js                   # Push Notification Service Worker
│
└── docs/                       # Documentation
    ├── README.ko.md            # Korean documentation
    ├── ROADMAP.md
    ├── HANDOVER_CONTEXT_AWARE_FIX.md
    └── REQUIREMENTS_UNIVERSAL_AUTO_FIX.md

API Endpoints

URL Scan

Method	Endpoint	Description
`POST`	`/api/scan`	Start URL scan
`GET`	`/api/scan/{scan_id}`	Get scan status/results
`GET`	`/api/scan/{scan_id}/export`	Export PDF/CSV

Repo Scan

Method	Endpoint	Description
`POST`	`/api/repo-scan`	Start GitHub repo scan
`GET`	`/api/repo-scan/{scan_id}`	Get repo scan status/results
`POST`	`/api/repo-scan/{scan_id}/analyze`	Run AI analysis
`POST`	`/api/repo-scan/{scan_id}/fix-prompt`	Generate fix prompt

GitHub Integration

Method	Endpoint	Description
`GET`	`/api/github/connection`	Check GitHub connection status
`POST`	`/api/github/connect`	Connect GitHub OAuth
`POST`	`/api/github/create-fix-pr`	Create fix PR
`POST`	`/api/github/fix-feedback`	Submit fix quality feedback
`DELETE`	`/api/github/connection`	Disconnect GitHub

AI Analysis

Method	Endpoint	Description
`POST`	`/api/analyze/{scan_id}`	Start AI analysis
`GET`	`/api/analyze/{vuln_id}`	Get analysis results

Badge

Method	Endpoint	Description
`POST`	`/api/badge/{scan_id}`	Issue badge
`GET`	`/api/badge/{badge_id}`	Get badge SVG

Scheduled Scans

Method	Endpoint	Description
`POST`	`/api/scheduled-scans`	Create scheduled scan
`GET`	`/api/scheduled-scans`	List scheduled scans
`DELETE`	`/api/scheduled-scans/{id}`	Delete scheduled scan
`POST`	`/api/cron/run-schedules`	Execute schedules (Cloud Scheduler)

History / Notifications

Method	Endpoint	Description
`GET`	`/api/scans/history`	Get scan history
`GET`	`/api/notifications/settings`	Get notification settings
`PUT`	`/api/notifications/settings`	Update notification settings

Webhooks

Method	Endpoint	Description
`POST`	`/api/billing/webhook`	Paddle billing webhook
`POST`	`/webhooks/github`	GitHub PR event webhook

Getting Started

Prerequisites

Node.js 20+
Python 3.11+
Nuclei, Semgrep, Gitleaks (security scanners)
Supabase account
Anthropic API key

1. Clone Repository

git clone --recurse-submodules https://github.com/Jaden-JJH/trust-security-scanner.git
cd trust-security-scanner

2. Frontend Setup

npm install
cp .env.example .env.local
npm run dev

Environment Variables (.env.local)

NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
NEXT_PUBLIC_API_URL=http://localhost:8000
NEXT_PUBLIC_GITHUB_APP_CLIENT_ID=your-github-app-client-id

3. Backend Setup

cd backend
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
uvicorn app.main:app --reload --port 8000

Deployment

Frontend (Vercel)

Auto-deploys on push to main branch via GitHub integration.

Backend (Cloud Run)

cd backend
gcloud builds submit --tag gcr.io/[PROJECT_ID]/trust-backend
gcloud run deploy trust-backend \
  --image gcr.io/[PROJECT_ID]/trust-backend \
  --platform managed --region asia-northeast3 \
  --allow-unauthenticated

License

MIT License

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

1Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Servers

Security Scanner MCP Server
Security Version Control Code Analysis
rupeedev
A
license
-
quality
D
maintenance
Enables comprehensive security scanning of code repositories to detect secrets, vulnerabilities, dependency issues, and configuration problems. Provides real-time security checks and best practice recommendations to help developers identify and prevent security issues.
Updated a year ago (2025-08-07 17:52 UTC)
12
2
MIT
Security MCP Server
Security Code Analysis Testing & QA Tools
michoo
A
license
-
quality
B
maintenance
Enables security scanning of codebases through integrated tools for secret detection, SCA, SAST, and DAST vulnerabilities, with AI-powered remediation suggestions based on findings.
Updated 2 months ago (2026-06-10 21:59 UTC)
MIT
Security Scanner MCP
Code Analysis Security Testing & QA Tools
ongjin
A
license
-
quality
D
maintenance
Automatically detects security vulnerabilities in AI-generated code, scanning for hardcoded secrets, injection flaws, XSS, weak cryptography, authentication issues, path traversal, and vulnerable dependencies across JavaScript, Python, Java, and Go.
Updated 3 months ago (2026-05-20 13:27 UTC)
30
2
MIT
MCP Security Scanner
Security Code Analysis Testing & QA Tools
JMitac
A
license
A
quality
D
maintenance
Enables comprehensive security scanning of code projects, detecting vulnerabilities in dependencies, code patterns (XSS, eval, etc.), and exposed secrets, with detailed reports in Spanish prioritized by severity.
Updated 8 months ago (2025-12-09 22:57 UTC)
4
21
MIT

View all related MCP servers

Related MCP Connectors

GitLumen MCP
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
LaunchTrust
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.
Frogeye Security Scanner
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Jaden-JJH/trust-security-scanner'

If you have feedback or need assistance with the MCP directory API, please join our Discord server