agentforge-trust-mcp is a proxy providing a single MCP connection to discover, trust-audit, and invoke tools across 100+ MCP servers.
Trust & Audit Tools:
check_trust: Fetch a Trust Score (0–100) for any MCP server (by slug, UUID, or GitHub URL), with per-dimension breakdowns across security scan, code health, behavioral audit, community trust, and EU compliance.
evaluate_policy: Evaluate a server against custom trust criteria (minimum scores, required/forbidden badges) to get an allowed: true/false decision — useful for gating agent actions.
list_trusted: Search the catalog by category and minimum trust threshold, returning up to 25 results sorted by trust score.
recommend: Describe a use case in natural language and receive ranked, trust-filtered server recommendations via semantic search.
Action Tools (require API key):
discover: Browse the full MCP server catalog with full-text or semantic search, including trust scores and connection metadata.
register_agent: Self-register to obtain an API key for action tools.
broadcast_search: Execute a query across multiple servers simultaneously, with aggregated and ranked results.
call_tool: Invoke any tool on any cataloged server via a proxy that handles authentication, quotas, and trust gating.
Security: Includes a built-in RCE sanitization layer with input validation, call guards, and anomaly detection.
Integration: Works with Claude Desktop, Cursor, LangGraph, AutoGen, CrewAI, and more — setup in ~3 minutes.
One MCP connection → 100+ MCP servers, with trust audit, discovery, and execution.
AgentForge gives any agent a single connection that exposes the entire catalog of MCP servers — trust-scored, searchable, and executable. Trust Scores (0–100) are computed across five dimensions: code health, security scan, behavioral audit, community trust, and EU compliance.
v0.3.0 ships 8 tools (4 trust + 4 action) plus a P0 RCE sanitization
layer (input validation, call guards, anomaly detection) with 27/27
tests passing and zero external runtime dependencies.
📖 Full integration guide for external multi-agent systems: See agentforge.community/trust for the full integration guide — OpenClaw, Claude Desktop, Cursor, LangGraph, AutoGen, CrewAI in ~3 minutes.
npx -y agentforge-trust-mcp@latest{
"mcpServers": {
"agentforge": {
"command": "npx",
"args": ["-y", "agentforge-trust-mcp@latest"],
"env": {
"AGENTFORGE_API_URL": "https://agentforge.community",
"AGENTFORGE_API_KEY": "af_agent_REPLACE_AFTER_REGISTRATION"
}
}
}
}Trust tools (
check_trust,evaluate_policy,list_trusted,recommend) work without an API key. Action tools (broadcast_search,call_tool) require self-registration viaregister_agent(one tool call, no signup).
Variable | Default | Purpose |
|
| Override for self-hosted |
| none | Enterprise tier (private catalogs, custom policies) |
Related MCP server: Agent Identity MCP Server
check_trustReturns the AgentForge Trust Score for a server identified by server_id,
slug, or github_url. Always call this before connecting to a new server.
evaluate_policyAllow/deny gate. Pass a policy like {min_overall: 70, required_badges: ["actively_maintained"]}
and get back allowed: true|false with per-check detail.
list_trustedSearch the AgentForge catalog for servers matching a category and trust threshold. Useful for "find me a secure database MCP server with overall ≥ 80".
recommendNatural-language search with trust filter. "I need to validate Czech VAT IDs" returns ranked results filtered by minimum trust.
discoverBrowse the entire catalog with full-text or semantic search. Returns ranked results with trust scores, categories, and connection metadata. No API key required — read-only catalog access.
broadcast_search (API key)Run a single query across N servers in one call. AgentForge fans out the search, aggregates results, and returns a unified ranked list. Pay-per-call billing through your wallet.
call_tool (API key)Invoke any tool on any server in the catalog through AgentForge's proxy. One connection, hundreds of downstream servers — the proxy handles auth, quotas, and trust gating.
register_agentSelf-register your agent and receive an af_agent_* API key. No human
signup, no dashboard — first tool call returns the key. Pass name,
description, capabilities, optional homepage_url and metadata.
Agent: user wants me to use "some-financial-mcp" server.
Agent: let me check its trust first…
→ check_trust(slug="some-financial-mcp")
← overall_score: 42, badges: [], security_scan: pending
Agent: trust is too low, skipping. Let me find alternatives.
→ recommend(query="invoice conversion Czech VAT", min_overall=75)
← 3 results with scores 87, 84, 79
Agent: connecting to the 87-scored server instead.Agent: I need flight + weather + currency data for a trip planner.
Agent: register once if I haven't already…
→ register_agent(name="TripPlanner", capabilities=["travel"])
← af_agent_xyz123
Agent: broadcast across travel-tagged servers.
→ broadcast_search(query="flights Prague→Tokyo May 15", category="travel")
← results from 4 servers, all trust ≥ 75
Agent: invoke top result through the proxy.
→ call_tool(server="skyscanner-mcp", tool="search_flights", args={...})
← booking resultsNo need to install or configure individual MCP servers — one connection to AgentForge, and your agent can reach the whole catalog.
Dimension | Weight | Source |
Security Scan | 30% | Snyk, GitHub Advisory, secret scanning |
Code Health | 20% | Commit recency, issue ratio, license |
Behavioral Audit | 20% | Claude-powered source review, red flag detection |
Community Trust | 15% | Stars, forks, author reputation |
EU Compliance | 15% | GDPR, AI Act, data residency |
Audits rotate every 14 days; evaluate_policy reports partial: true if not
all dimensions are current.
MIT — AgentForge 2026
Fetch the AgentForge Trust Score for an MCP server. Returns the overall score (0-100), per-dimension breakdown (code_health, security_scan, behavioral_audit, community_trust, eu_compliance), and badges. Use before connecting to any MCP server.
| Name | Required | Description | Default |
|---|---|---|---|
| server_id | No | AgentForge server UUID (preferred) | |
| slug | No | AgentForge server slug | |
| github_url | No | Upstream GitHub repo URL, e.g. https://github.com/owner/repo |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description must carry the full burden. It discloses the return structure (overall score, per-dimension breakdown, badges) and implies a read-only operation. It does not mention any destructive side effects or auth requirements, but the lack of annotations is a gap, not a contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first sentence states the action and outputs, second provides usage guidance. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 optional params, no output schema), the description covers the purpose, key outputs, and usage hint. It lacks details on optional parameter interactions or default behavior when multiple params are provided, but the return structure is sufficiently explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (all three parameters have descriptions in the schema). The description adds value by listing the return fields and usage hint, but no additional parameter-level details beyond what the schema provides. Baseline 3 is elevated to 4 because the description explains what the tool returns, which helps in parameter choice.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch' and the resource 'AgentForge Trust Score for an MCP server', specifying what is returned (score, breakdown, badges) and distincts from siblings like list_trusted (which lists multiple) and evaluate_policy (which evaluates policies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description ends with 'Use before connecting to any MCP server', providing clear usage context. However, it does not explicitly mention when NOT to use it or alternative tools for other purposes, which would be helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check whether a server passes a trust policy. Returns allowed:true/false plus individual check results. Example policy: {min_overall: 70, required_badges: ['actively_maintained']}. Use this to gate agent decisions like 'should I use this server for financial data?'.
| Name | Required | Description | Default |
|---|---|---|---|
| server_id | No | ||
| slug | No | ||
| github_url | No | ||
| policy | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are missing, so description carries the burden. It explains return format (allowed:true/false plus individual checks) but does not disclose whether the tool modifies state, requires authentication, or has rate limits. No contradictions, but adds moderate value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences plus a policy example. Extremely concise, no filler. Front-loaded with core purpose, then example clarifies usage. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given moderate complexity (4 parameters, nested object, no output schema), the description is complete enough: states purpose, return format, and gives example. No explanation of individual parameters beyond the example, but the schema and example together suffice.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It does not detail parameters but provides a comprehensive example policy that covers most parameter fields intuitively. For a nested object with 5 sub-fields, the example aids understanding significantly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool checks trust policy, returns allowed:true/false with details, and provides a real example. This distinguishes it from siblings like 'recommend' or 'list_trusted'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a use-case example for gating decisions about server use for financial data, but does not explicitly mention when not to use this tool vs alternatives like check_trust.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search AgentForge catalog for servers matching a category and minimum trust threshold. Returns up to 25 results sorted by trust score.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Category filter (e.g. finance, database, developer-tools, security). Omit for all. | |
| min_overall | No | ||
| required_badges | No | ||
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses key behaviors: returns up to 25 results sorted by trust score. However, it does not clarify whether the operation is read-only, requires authentication, or has side effects. A score of 3 is appropriate as it adds some context that is missing from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, clear and front-loaded. No redundancy. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of 4 parameters, no annotations, and no output schema, the description provides essential context but still leaves gaps (e.g., what 'trust score' represents, behavior of 'required_badges'). It is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 25% (only 'category' has a description). The description adds clarity by stating that 'category' can be omitted for all, and implicitly relates 'min_overall' to the 'minimum trust threshold'. However, it does not explain 'required_badges' or 'limit' beyond the schema defaults. With low coverage, a 3 is reasonable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action ('search'), the resource ('AgentForge catalog'), and the scope ('servers matching a category and minimum trust threshold'). It also adds valuable context about the result set (max 25, sorted by trust score). This fully distinguishes it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for finding servers by category and trust threshold, but does not provide explicit guidance on when to use this tool vs alternatives. It does not mention when not to use it or contrast with sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Given a natural-language use case, recommend MCP servers filtered by trust. Example: 'I need to validate Czech VAT IDs and convert ISDOC invoices'. Uses AgentForge semantic search + trust filter.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Natural language description of the use case | |
| min_overall | No | ||
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions that the tool uses 'AgentForge semantic search + trust filter', which is helpful, but it does not disclose side effects, destructive potential, or any rate limits. A score of 3 is fair because the description adds meaningful technical context but lacks full behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences plus an example; every clause serves a purpose. It is front-loaded with the core purpose and includes a concrete example to illustrate usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, no output schema, and no annotations, the description is mostly complete for a search/recommendation tool. It covers the input format (natural language), the filtering mechanism (trust filter), and provides an example. A minor gap is not specifying the output format, but for a recommendation tool, the lack of an output schema is less critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 33% (only 'query' has a description). The description adds semantics for the purpose of the tool but does not elaborate on parameters beyond the example. However, it provides a natural-language context that helps infer the role of 'query', and the default values for 'min_overall' and 'limit' are self-explanatory. Given the moderate coverage, the description provides added value by framing the use case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('recommend'), a clear resource ('MCP servers'), and the filtering criterion ('by trust'). It also provides a concrete example ('validate Czech VAT IDs and convert ISDOC invoices'), which distinguishes it from siblings like check_trust or list_trusted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates when to use this tool: given a natural-language use case. However, it does not explicitly mention when not to use it or directly contrast with siblings, though the example and purpose imply it's for recommendations rather than trust checking or listing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0check_trustevaluate_policylist_trustedrecommendScored across 4 tools
Each tool has a clearly distinct purpose: check_trust evaluates a server's score, evaluate_policy checks policy compliance, list_trusted searches for servers by criteria, and recommend provides natural-language recommendations. No overlap.
Tool names consistently use imperative verbs (check, evaluate, list, recommend) without nouns, which is a simple pattern. However, 'list_trusted' omits a noun like 'servers' for clarity, and the pattern could be slightly more descriptive, but overall consistent.
With only 4 tools, the scope is focused on trust evaluation and discovery. Each tool addresses a core need: score check, policy evaluation, search, and recommendation. No unnecessary tools, and the count feels appropriate for a trust-assessment server.
The tool surface covers key operations: retrieving trust scores, checking policies, searching, and recommending. Minor gaps might include batch operations or detailed audit logs, but the core functionality for trust assessment is well-covered.
Independent trust scores, tool surfaces and change history for MCP servers.
Trust checks for MCP servers: trust scores, tool-drift detection, signed diligence receipts. Free.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Trust verification for MCP servers. Check scores, scan for security issues, search 4,200+ servers.
