ToolTrust Scanner — Claude Code MCP server: features and setup
Audits MCP tool specifications before your agent executes them. Identifies permission mismatches, code execution risks, and grades servers from A to F.
claude mcp add tooltrust-scanner -- npx -y tooltrust-mcpWhat ToolTrust Scanner does
ToolTrust Scanner checks agent tool definitions against static security rules. It runs directly as a subprocess via stdio. No open network ports are needed. The server inspects MCP configurations, connects to listed endpoints in parallel, and returns a structured risk breakdown.
The scanner catches arbitrary script execution patterns and credential leaks in input schemas. It also compares package metadata with an inventory of compromised libraries. This blacklist runs completely offline. Zero network calls are required for known bad packages.
When a server omits repository links or dependency details, supply-chain analysis flags coverage as incomplete. This limitation leaves blind spots in third-party code. Always inspect unverified tools manually.
What it helps with
- spot arbitrary code execution hooks inside tool definitions
- catch sensitive credential leaks in input schemas
- flag compromised third-party dependencies using offline lists
- detect name spoofing and tool shadowing across MCP servers
Example prompts for the agent
- Run tooltrust_scan_config to audit active MCP servers
- Scan our MCP configuration and display the security grades
How to install ToolTrust Scanner
Platform CLI
claude mcp add tooltrust-scanner -- npx -y tooltrust-mcpPlatform CLI
codex mcp add tooltrust-scanner -- npx -y tooltrust-mcpConfig file
{
"mcpServers": {
"tooltrust-scanner": {
"command": "npx",
"args": [
"-y",
"tooltrust-mcp"
]
}
}
}Config file
{
"servers": {
"tooltrust-scanner": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"tooltrust-mcp"
]
}
}
}Platform CLI
gemini mcp add tooltrust-scanner npx -y tooltrust-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ToolTrust Scanner
How to install ToolTrust Scanner in Claude Code?
Run claude mcp add tooltrust-scanner -- npx -y tooltrust-mcp in your terminal. Claude Code connects to it as a subprocess using stdio.
What does ToolTrust Scanner do?
It runs static security checks on tool schemas across your MCP environment. Each tool receives an evaluation and a letter grade from A to F based on detected risk factors.
Does ToolTrust Scanner require internet access to check packages?
Known compromised packages are matched against an embedded offline list without making network requests. Checking external vulnerabilities via OSV does require an internet connection.
