TrustedMCP MCP server

Give your agent the TrustedMCP grades. Ask it "is this MCP server any good?" or "check my MCP setup", and it answers with an A to D grade per server, what to fix first, and better-graded servers in the same category.

Each grade is an assessment from public signals: login, upkeep, known CVEs and how the server connects. Use it as a starting point for your own review. It is not an audit of the code. How we grade.

Tools

All four tools only read data.

Related MCP server: repo-doctor

Get a key

Tool calls need a free API key. Sign up with your email at trustedmcp.io/developers. The server still starts and lists its tools without one, but every tool call returns an error that tells you to add a key.

Keys are scoped. A key can have any of these three scopes:

registry_lookup also falls back to a server search when you give it a package name or search term instead of a registry name, so give the key servers:read as well. If a key lacks the scope a tool needs, the tool says which scope is missing. You can revoke or rotate a key on the same page. A revoked or invalid key is rejected, and the tool tells you to get a new one.

Install

Hosted (no install)

TrustedMCP also runs as a hosted server at https://trustedmcp.io/mcp. It has the same four tools. Nothing to install, no Node.js needed. Send your key as a Bearer token.

Claude Code:

claude mcp add --transport http trustedmcp https://trustedmcp.io/mcp --header "Authorization: Bearer YOUR_KEY"

Cursor (~/.cursor/mcp.json):

{
  "mcpServers": {
    "trustedmcp": {
      "url": "https://trustedmcp.io/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

VS Code (.vscode/mcp.json):

{
  "servers": {
    "trustedmcp": {
      "type": "http",
      "url": "https://trustedmcp.io/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

The hosted server can't read files on your machine, so check_config needs your config pasted in as the config argument. The npx version below reads your config files locally.

Run locally with npx

Needs Node.js 18 or later.

Claude Code

claude mcp add trustedmcp -e TRUSTEDMCP_API_KEY=YOUR_KEY -- npx -y trustedmcp mcp

Claude Desktop, Cursor, Windsurf (claude_desktop_config.json, ~/.cursor/mcp.json, ~/.codeium/windsurf/mcp_config.json)

{
  "mcpServers": {
    "trustedmcp": {
      "command": "npx",
      "args": ["-y", "trustedmcp", "mcp"],
      "env": { "TRUSTEDMCP_API_KEY": "YOUR_KEY" }
    }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "trustedmcp": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "trustedmcp", "mcp"],
      "env": { "TRUSTEDMCP_API_KEY": "YOUR_KEY" }
    }
  }
}

Then ask: "Check my MCP config with TrustedMCP", or "What grade does @playwright/mcp get, and is there something better?"

What leaves your machine

With the hosted endpoint, whatever you pass to a tool is sent to trustedmcp.io. The rest of this section is about the npx version.

check_config reads your config file on your machine. It sends TrustedMCP only:

• each server's name in your config, and

• the package names (npm:@playwright/mcp), image names (oci:ghcr.io/github/github-mcp-server) and server URLs it found, without query strings.

Environment variables, headers, tokens, other arguments and file paths stay on your machine. A server that runs a local file (node ./server.js) is not sent at all; the tool tells you it can't be looked up. The API doesn't store what it receives. The code that builds those identifiers is in src/identifiers.ts and src/config.ts.

Settings

The API

The server is a thin client for the free TrustedMCP JSON API (https://trustedmcp.io/api/v1: /servers, /servers/{slug}, /lookup, /check, /registry/{name}, /categories). Docs and terms: trustedmcp.io/developers. Where you show a grade, credit "Grades by TrustedMCP" and link to the server's page.

Develop

npm install
npm test        # vitest
npm run build   # tsc to dist/
TRUSTEDMCP_API_URL=http://127.0.0.1:8000/api/v1 node dist/cli.js mcp

Tool calls need a key even when you point TRUSTEDMCP_API_URL at a local copy.

Release (maintainers): bump version in package.json and both version fields in server.json (top level and packages[0]), npm publish, then node scripts/publish-registry.mjs to publish the same version to the official MCP Registry. That script needs the domain key for io.trustedmcp/*; it never leaves the maintainer's machine.

Use it as a library:

import { createServer, TrustedMcpApi } from 'trustedmcp';

Missing a server?

If a server you use has no grade, ask for one.

License

MIT