OWASP-mapped · Agentic + LLM Top 10
A trust score for every AI agent.
AgentTrust is a free, local-first security scanner for AI agents and MCP servers. Eight static rules, a permission manifest, and a Trust Card graded A–F — in seconds, with zero data leaving your machine.
Free forever · No account · Open source (Apache-2.0) · Install in 60 seconds
How it works
Three steps to a verifiable grade.
Point at anything
A local directory, a GitHub URL, or an npm package. Recursive detection, eight rules, permission extraction, dependency audit. Seconds, locally.
Get a Trust Card
Letter grade A–F, 0–100 score, OWASP-mapped findings with file:line, plus SARIF for your Security tab and a --fail-on CI gate.
Share the evidence
Embed a bound badge that links to a public report page — grade image and evidence travel together. See the live registry.
The registry · 50 servers, re-scanned weekly
Who's passing, who's not.
Independently scanned snapshots — not self-reports. Full evidence behind every grade.
| A | mcp-cli | 96 |
| A | pinecone-mcp | 95 |
| A | tavily-mcp | 94 |
| A | java-sdk | 94 |
| A | terraform-mcp-server | 93 |
| F | blender-mcp | 35 |
| F | fastmcp | 37 |
| F | mcp-use | 37 |
| F | mongodb-mcp-server | 39 |
| D | agent-toolkit | 40 |
Scope predicts the grade.
Every A-grade server pairs zero findings with minimal scope. All D/F servers are excessive-scope except two. How scoring works · Explore all 50 →
Install
Running in 60 seconds.
npm install -g @eulogik/agenttrust agenttrust scan ./my-mcp-server --quiet
No install? Run it directly with npx @eulogik/agenttrust scan . From source: git clone https://github.com/eulogik/AgentTrust.git && cd AgentTrust && npm install. Enforce it in CI:
agenttrust scan . --fail-on high --quiet --output-dir ./trust
Or drop in the GitHub Action — scan plus SARIF upload to your Security tab.
Pricing
The CLI is the product. It's free.
$0, forever
Unlimited local scans, Trust Cards, bound badges, SARIF, CI gate. Open source, zero telemetry.
Scoped per target
Manual triage of your results plus a remediation plan, on request. Contact us.
FAQ
Asked, answered.
What is AgentTrust?
AgentTrust is a free, local-first security scanner for AI agents and MCP servers. It runs 8 OWASP-mapped static rules, extracts a permission manifest, and issues a Trust Card graded A–F — with SARIF output for CI. It answers: can I trust this agent, what may it do, and can I prove it?
How do I scan an MCP server?
Point the CLI at a local directory, a GitHub URL, or an npm package. You get a Trust Card, SARIF and Markdown reports in seconds. Nothing leaves your machine — GitHub targets are cloned to a temp directory locally.
What is a Trust Card?
A portable, machine-readable credential (agenttrust/trust-card/v1): letter grade, 0–100 score, findings with file:line evidence, permission scope, provenance signals, and inferred host compatibility. Bound badges link each grade to its public evidence page.
Is AgentTrust a certification?
No. AgentTrust is a static scanner, not a certification body. Attack analysis is heuristic (no payloads execute), workflow eval is simulated (nothing runs), and Trust Cards are evidence input for your own review — never a compliance verdict.
Does my code leave my machine?
No. Zero telemetry, zero retention. The scanner reads files, computes locally, and writes reports to a directory you choose.
What do the grades mean?
A (90+) through F (below 40), weighted across security findings, permission scope, provenance, reliability and stability. Across 50 public MCP servers the average is 70.2 (C); 36% grade D or F. Full scoring methodology.
Why does the AgentTrust repo itself grade F?
Because it contains its own test ammunition — and a scanner that didn't flag it would be the real scandal. The F comes from three intentional sources: (1) examples/vulnerable-mcp-server, a deliberately vulnerable fixture; (2) our unit tests, which must contain eval(, exec( and transferFunds( strings to prove the detector catches them; (3) our automation scripts, which legitimately shell out to git and npm with hardcoded local arguments. The shipped product (packages/cli) self-scans at A (90/100) — that is what the README badge grades. Rule of thumb: grade the artifact you ship, not the monorepo that tests it.
Ship agents you can defend.
One command. Thirty seconds. A grade you can show your auditor.