TrustedMCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TRUSTEDMCP_API_KEY | No | Optional free key from trustedmcp.io/developers. Raises the limit from 30 to 300 requests a minute. | |
| TRUSTEDMCP_API_URL | No | API base URL, for testing against another copy. | https://trustedmcp.io/api/v1 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
TrustedMCP grades MCP servers A to D from public signals: login, upkeep, known CVEs and how the server connects. Use lookup_server when the user asks about one MCP server; check_config to review every server in their MCP setup (call it with no arguments to scan the usual config files); find_alternatives for better-graded servers; registry_lookup for an official MCP Registry entry and its reported security issues. Present a grade as an assessment from public signals and a starting point for the user's own review, never as proof that a server is safe.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lookup_serverA | Get an MCP server's TrustedMCP grade (A-D) by name, npm or PyPI package, Docker image, server URL, GitHub repo or launch command (e.g. 'npx -y @playwright/mcp'). Returns the four checks (login, upkeep, known bugs, connection), what to fix first and the TrustedMCP page. For servers without a grade, returns matching official MCP Registry entries. |
| check_configA | Grade every MCP server in an MCP config. With no arguments, reads the usual config files on this machine (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf). Or pass |
| find_alternativesA | List TrustedMCP-graded MCP servers, best grade first. Filter by category ('databases', 'browser automation'), a search term, or the minimum grade; or pass |
| registry_lookupA | Get an official MCP Registry entry ('io.github.owner/repo') with its packages, remotes, TrustedMCP grade if any, and reported security issues (GHSA/CVE advisories, and whether the listed version is affected). Also accepts a package name or search term and picks the best matching entry. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
check_config and find_alternatives are clearly distinct purposes, but lookup_server and registry_lookup overlap heavily: both accept a package name or search term, both return a TrustedMCP grade, and lookup_server even falls back to returning registry entries. An agent must infer 'grade-first vs registry-entry-first' intent from subtle wording rather than a clear boundary.
All four names are snake_case and readable, with three following verb_noun (lookup_server, check_config, find_alternatives). Only registry_lookup flips to noun_verb, a minor deviation that still reads sensibly.
Four tools is a tight, sensible surface for a server-grading service: single lookup, bulk config audit, discovery, and registry metadata. It is slightly lean (no way to browse all categories or compare two servers directly), but every tool earns its place.
The lifecycle is largely covered: query one server, audit a whole config, find better-graded replacements, and fetch registry/security advisories. Minor gaps exist around cross-server comparison, grade explanation/reporting, and enumerating categories, none of which blocks core agent workflows.