Is that MCP package safe?
Scan any npm package for security issues. Free. Instant.
Try: mcp-trust-guard, @modelcontextprotocol/server-filesystem, or any npm package
Install Scripts
Detects postinstall hooks that run arbitrary code
Prompt Injection
Finds instruction-like patterns in package metadata
Suspicious URLs
Flags raw IPs, sketchy TLDs, exfiltration endpoints
Dependencies
High dependency count means larger attack surface
Missing Metadata
No licence or repo link means unverifiable code
Continuous Monitoring
Continuous reassessment. Get alerted when a package or its dependencies change risk.
The MCP ecosystem needs a trust layer
The official MCP Registry lists servers but does not audit them. Anthropic does not manage or assess MCP server security. The registry is designed to delegate trust decisions to downstream services.
AgentScore is that downstream layer. We scan, monitor, and assess MCP packages so registries, clients, and teams can make informed install and connect decisions.
Verdict API
Allow, warn, or block. One call.
Exposure API
Which MCP servers are affected by incident X?
Continuous Monitoring
250+ packages. Changes detected in minutes.
MCP security for compliance teams
Under ISO 27001, MCP servers are third-party software components requiring asset inventory (A.8.1), vulnerability assessment (A.12.6), and supplier risk management (A.15.1). AgentScore provides the evidence trail.
What MCP servers do you use?
Server inventory with risk classification
How do you assess them?
Timestamped scans with scores and findings
What vulnerabilities exist?
Every finding tracked with severity
How often do you reassess?
Daily monitoring with change alerts
A scan is a snapshot. Monitoring is the product.
Packages change. Dependencies update. New vulnerabilities appear. We rescan your MCP dependencies continuously and alert you when something changes.
Protect your MCP server
Add security middleware. Abuse database, rate limiting, tool permissions.
npm install mcp-trust-guard
const guard = new McpGuard({ abuseCheck: true });
app.use('/mcp', guard.middleware());