davidnichols-ops/MCP Trustcard
Security healthcheck for MCP servers. Scores tools, destructive caps, auth, secrets. Fails CI below threshold.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| server | npm package spec of the MCP server to scan (e.g. @modelcontextprotocol/server-github). Required unless using scan-config mode. | no | "" |
| min-score | Minimum score (0-100) required to pass. Default 50. | no | 50 |
| json-out | Path to write the JSON report. Optional. | no | "" |
| save-manifest | Path to save a tool manifest for proxy enforcement. Optional. Generates a manifest JSON with tool names + schema hashes that mcp-proxy can enforce at call time. | no | "" |
| scan-config | Path to an MCP config file to scan for exposed secrets (GitHub tokens, API keys, Bearer tokens). When set, runs scan-config instead of a server scan. | no | "" |
Outputs
no outputs