Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@trustlists Audit my package.json for vendor security"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
The trustlists_ plugin gives your AI assistant access to thousands of public company trust center records, local SOC 2 analysis, and SafeBase/Vanta access requests.
Tool | What it does | Cost |
| Search thousands of trust centers by name or domain | Free |
| Look up a single vendor by exact domain | Free |
| Filter by platform, listed framework, or CSA STAR level | Free |
| Audit | Free |
| Device-code sign-in ( | Free |
| Analyze local SOC 2 PDFs after a credit preview | Credits |
| Identity used on vendor access forms | Free |
| Request SafeBase or Vanta access (max 5 per batch) | Free (beta) |
https://mcp.trustlists.org/mcp serves the same tools over Streamable HTTP after
an OAuth sign-in with a trustlists account (Google or Microsoft). Connecting the
app replaces trustlists_login and trustlists_logout. Because a hosted server
cannot read your disk, the dependency audit takes pasted manifest text, and SOC 2
PDFs are uploaded in the trustlists app via trustlists_soc2_upload.
The plugin ships with skills your AI assistant uses automatically:
lookup-vendor - Find a vendor's trust center and listed frameworks
audit-dependencies - Map project dependencies to public trust center records
compliance-quick-check - Check whether a directory record lists a requested framework
sign-in - Connect a trustlists account with a device code
analyze-soc2 - Preview credits, then analyze a local SOC 2 PDF
request-trust-center-access - Complete the requester profile and request access
Related MCP server: mcp-dependency-version
In Cursor or Claude Code, just ask:
"Look up Stripe's trust center"
"Audit my package.json for vendor security"
"Does Datadog's trust center list HIPAA information?"
The AI uses the plugin's tools to answer with current public trustlists data. A directory record is a discovery aid, not an audit, certification, endorsement, or security rating.
Add this to your MCP config and restart:
{
"mcpServers": {
"trustlists": {
"command": "npx",
"args": ["-y", "@trustlists/mcp"]
}
}
}App | Config location |
Cursor | Settings → MCP → Edit config (or |
Claude Desktop |
|
Claude Code |
|
Full installation guide → (includes troubleshooting)
The directory and audit tools are free and require no trustlists account. SOC 2 analysis and access requests use a device-code login on the local MCP.
Free MCP tools - Search, lookup, browse, and dependency mapping
Signed-in MCP tools - SOC 2 analysis (credits) and trust-center access requests
Companion - The same account workflows in the browser at app.trustlists.org
Visit the MCP overview for setup and tool details, or trustlists.org for the full directory and Companion subscriptions.
# Install dependencies
npm install
# Build the MCP server
npm run build
# Test locally
npm run test:localSee docs/development.md for the full development guide.
Apache 2.0. See LICENSE and NOTICE.
This server cannot be deployed
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
Live trust signals for domains & packages: age, registrar, typosquat resemblance.
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
