AIエージェントがMCPサーバーを使用する前に監査できるようにするMCPサーバー。
AgentForgeは、カタログ内のすべてのMCPサーバーに対して、コードの健全性、セキュリティスキャン、行動監査、コミュニティの信頼性、EUコンプライアンスの5つの側面から算出された信頼スコア（0〜100）を維持しています。このMCPサーバーは、それらの監査結果をエージェントが呼び出せるツールとして公開します。
npx -y agentforge-trust-mcp{
"mcpServers": {
"agentforge-trust": {
"command": "npx",
"args": ["-y", "agentforge-trust-mcp"]
}
}
}変数 | デフォルト | 用途 |
|
| セルフホスト用の上書き |
| なし | エンタープライズ層（プライベートカタログ、カスタムポリシー） |
Related MCP server: Agent Identity MCP Server
check_trustserver_id、slug、またはgithub_urlで識別されるサーバーのAgentForge信頼スコアを返します。新しいサーバーに接続する前に必ず呼び出してください。
evaluate_policy許可/拒否のゲートです。{min_overall: 70, required_badges: ["actively_maintained"]}のようなポリシーを渡すと、チェックごとの詳細とともにallowed: true|falseが返されます。
list_trustedカテゴリと信頼しきい値に一致するサーバーをAgentForgeカタログから検索します。「総合スコア80以上の安全なデータベースMCPサーバーを探して」といった用途に便利です。
recommend信頼フィルターを使用した自然言語検索です。「チェコのVAT IDを検証する必要がある」と入力すると、最小信頼度でフィルタリングされたランキング結果が返されます。
Agent: user wants me to use "some-financial-mcp" server.
Agent: let me check its trust first…
→ check_trust(slug="some-financial-mcp")
← overall_score: 42, badges: [], security_scan: pending
Agent: trust is too low, skipping. Let me find alternatives.
→ recommend(query="invoice conversion Czech VAT", min_overall=75)
← 3 results with scores 87, 84, 79
Agent: connecting to the 87-scored server instead.側面 | 重み | ソース |
セキュリティスキャン | 30% | Snyk、GitHub Advisory、シークレットスキャン |
コードの健全性 | 20% | コミットの頻度、課題比率、ライセンス |
行動監査 | 20% | Claudeによるソースレビュー、レッドフラグ検出 |
コミュニティの信頼性 | 15% | スター数、フォーク数、作成者の評判 |
EUコンプライアンス | 15% | GDPR、AI法、データレジデンシー |
監査は14日ごとに更新されます。すべての側面が最新でない場合、evaluate_policyはpartial: trueを返します。
MIT — AgentForge 2026
Fetch the AgentForge Trust Score for an MCP server. Returns the overall score (0-100), per-dimension breakdown (code_health, security_scan, behavioral_audit, community_trust, eu_compliance), and badges. Use before connecting to any MCP server.
| Name | Required | Description | Default |
|---|---|---|---|
| server_id | No | AgentForge server UUID (preferred) | |
| slug | No | AgentForge server slug | |
| github_url | No | Upstream GitHub repo URL, e.g. https://github.com/owner/repo |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description must carry the full burden. It discloses the return structure (overall score, per-dimension breakdown, badges) and implies a read-only operation. It does not mention any destructive side effects or auth requirements, but the lack of annotations is a gap, not a contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first sentence states the action and outputs, second provides usage guidance. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 optional params, no output schema), the description covers the purpose, key outputs, and usage hint. It lacks details on optional parameter interactions or default behavior when multiple params are provided, but the return structure is sufficiently explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (all three parameters have descriptions in the schema). The description adds value by listing the return fields and usage hint, but no additional parameter-level details beyond what the schema provides. Baseline 3 is elevated to 4 because the description explains what the tool returns, which helps in parameter choice.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch' and the resource 'AgentForge Trust Score for an MCP server', specifying what is returned (score, breakdown, badges) and distincts from siblings like list_trusted (which lists multiple) and evaluate_policy (which evaluates policies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description ends with 'Use before connecting to any MCP server', providing clear usage context. However, it does not explicitly mention when NOT to use it or alternative tools for other purposes, which would be helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check whether a server passes a trust policy. Returns allowed:true/false plus individual check results. Example policy: {min_overall: 70, required_badges: ['actively_maintained']}. Use this to gate agent decisions like 'should I use this server for financial data?'.
| Name | Required | Description | Default |
|---|---|---|---|
| server_id | No | ||
| slug | No | ||
| github_url | No | ||
| policy | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are missing, so description carries the burden. It explains return format (allowed:true/false plus individual checks) but does not disclose whether the tool modifies state, requires authentication, or has rate limits. No contradictions, but adds moderate value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences plus a policy example. Extremely concise, no filler. Front-loaded with core purpose, then example clarifies usage. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given moderate complexity (4 parameters, nested object, no output schema), the description is complete enough: states purpose, return format, and gives example. No explanation of individual parameters beyond the example, but the schema and example together suffice.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It does not detail parameters but provides a comprehensive example policy that covers most parameter fields intuitively. For a nested object with 5 sub-fields, the example aids understanding significantly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool checks trust policy, returns allowed:true/false with details, and provides a real example. This distinguishes it from siblings like 'recommend' or 'list_trusted'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a use-case example for gating decisions about server use for financial data, but does not explicitly mention when not to use this tool vs alternatives like check_trust.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search AgentForge catalog for servers matching a category and minimum trust threshold. Returns up to 25 results sorted by trust score.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Category filter (e.g. finance, database, developer-tools, security). Omit for all. | |
| min_overall | No | ||
| required_badges | No | ||
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses key behaviors: returns up to 25 results sorted by trust score. However, it does not clarify whether the operation is read-only, requires authentication, or has side effects. A score of 3 is appropriate as it adds some context that is missing from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, clear and front-loaded. No redundancy. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of 4 parameters, no annotations, and no output schema, the description provides essential context but still leaves gaps (e.g., what 'trust score' represents, behavior of 'required_badges'). It is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 25% (only 'category' has a description). The description adds clarity by stating that 'category' can be omitted for all, and implicitly relates 'min_overall' to the 'minimum trust threshold'. However, it does not explain 'required_badges' or 'limit' beyond the schema defaults. With low coverage, a 3 is reasonable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action ('search'), the resource ('AgentForge catalog'), and the scope ('servers matching a category and minimum trust threshold'). It also adds valuable context about the result set (max 25, sorted by trust score). This fully distinguishes it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for finding servers by category and trust threshold, but does not provide explicit guidance on when to use this tool vs alternatives. It does not mention when not to use it or contrast with sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Given a natural-language use case, recommend MCP servers filtered by trust. Example: 'I need to validate Czech VAT IDs and convert ISDOC invoices'. Uses AgentForge semantic search + trust filter.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Natural language description of the use case | |
| min_overall | No | ||
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions that the tool uses 'AgentForge semantic search + trust filter', which is helpful, but it does not disclose side effects, destructive potential, or any rate limits. A score of 3 is fair because the description adds meaningful technical context but lacks full behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences plus an example; every clause serves a purpose. It is front-loaded with the core purpose and includes a concrete example to illustrate usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, no output schema, and no annotations, the description is mostly complete for a search/recommendation tool. It covers the input format (natural language), the filtering mechanism (trust filter), and provides an example. A minor gap is not specifying the output format, but for a recommendation tool, the lack of an output schema is less critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 33% (only 'query' has a description). The description adds semantics for the purpose of the tool but does not elaborate on parameters beyond the example. However, it provides a natural-language context that helps infer the role of 'query', and the default values for 'min_overall' and 'limit' are self-explanatory. Given the moderate coverage, the description provides added value by framing the use case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('recommend'), a clear resource ('MCP servers'), and the filtering criterion ('by trust'). It also provides a concrete example ('validate Czech VAT IDs and convert ISDOC invoices'), which distinguishes it from siblings like check_trust or list_trusted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates when to use this tool: given a natural-language use case. However, it does not explicitly mention when not to use it or directly contrast with siblings, though the example and purpose imply it's for recommendations rather than trust checking or listing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0check_trustevaluate_policylist_trustedrecommendScored across 4 tools
Each tool has a clearly distinct purpose: check_trust evaluates a server's score, evaluate_policy checks policy compliance, list_trusted searches for servers by criteria, and recommend provides natural-language recommendations. No overlap.
Tool names consistently use imperative verbs (check, evaluate, list, recommend) without nouns, which is a simple pattern. However, 'list_trusted' omits a noun like 'servers' for clarity, and the pattern could be slightly more descriptive, but overall consistent.
With only 4 tools, the scope is focused on trust evaluation and discovery. Each tool addresses a core need: score check, policy evaluation, search, and recommendation. No unnecessary tools, and the count feels appropriate for a trust-assessment server.
The tool surface covers key operations: retrieving trust scores, checking policies, searching, and recommending. Minor gaps might include batch operations or detailed audit logs, but the core functionality for trust assessment is well-covered.
Independent trust scores, tool surfaces and change history for MCP servers.
Trust checks for MCP servers: trust scores, tool-drift detection, signed diligence receipts. Free.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Trust verification for MCP servers. Check scores, scan for security issues, search 4,200+ servers.
