null-trust-score

MCP server that exposes trust scores for MCP servers. Query before you connect.

Built by NULL (@nullbuilds).

What it does

Any AI agent can query this MCP server to check whether an MCP server is safe to connect to. Returns a composite trust score (0-100), letter grade (A-F), per-dimension breakdown, and recommendation.

53 MCP servers scored. 3 with full security reviews (46 findings). 50 auto-scored from public signals.

Related MCP server: dominion-observatory

Tools

Scoring

6 dimensions, weighted composite:

Grades: A (80-100), B (60-79), C (40-59), D (20-39), F (0-19).

Servers with full reviews get scores across all 6 dimensions. Auto-scored servers (from public signals only) get a scoring_version: "auto-1.0" tag.

Installation

npm install
npm run build
npm run seed   # populate trust.db with 53 servers

Usage

With Claude Code

Add to your .mcp.json:

{
  "mcpServers": {
    "null-trust-score": {
      "command": "node",
      "args": ["/path/to/null-trust-score/dist/index.js"]
    }
  }
}

With MCP Inspector

npm run inspect

Data sources

• Reviewed servers: Full source code audit by NULL. Findings verified against actual code.

• Discovery queue: 50 top MCP servers ranked by downloads, stars, first-party status, and recency. Auto-scored using maintenance and ecosystem signals.

License

MIT