MCP Trustcard v0.4.2

Fix npm resolution — fallback to /opt/homebrew/bin/npm when mise npm is broken. Scores improved across the board (memory 68→83, filesystem 72→87, github 68→82). Updated leaderboard with two-layer destructive analysis results.

MCP Trustcard v0.4.1

MCP Trustcard v0.4.1

Two incremental improvements over v0.4.0.

What's new

1. Config-injection support (--env-file)
Servers that require API keys (Brave Search, Notion, Slack, Supabase) can now be scanned by injecting env vars from a .env file:

mcp-trustcard --env-file .env @modelcontextprotocol/server-brave-search
mcp-trustcard --env-file .env -- uv run my-mcp-server
mcp-trustcard scan --env-file .env @modelcontextprotocol/server-brave-search --save-manifest brave.json

The env vars are passed to the spawned server process, allowing the handshake to succeed when credentials are required. This closes the gap where 134/159 servers in the registry failed because they needed API keys.

2. SSE integration tests
4 new tests covering the SSE (Server-Sent Events) code path in mcp-http-proxy:

• SSE initialize forwarding
• SSE tools/list with unapproved tool stripping
• SSE tools/call blocking for unapproved tools
• SSE tools/call allowing for approved tools

Stats

• 58 tests, all passing (was 49 in v0.4.0, +4 SSE tests, +5 env-file parsing tests)
• 14 files in npm package, 32.8 kB packed
• Zero dependencies — pure Node stdlib

MCP Trustcard v0.4.0

MCP Trustcard v0.4.0

Six production security fixes over v0.3.0.

What's new

1. Fixed false positives in destructive verb matching
Word-boundary regex instead of substring includes(). browser_navigate no longer matches "remove", duckduckgo_web_search no longer matches "search". Eliminates ~15 false positives from the v0.2.0 leaderboard.

2. Added 14 new destructive verbs
checkout, push, merge, fork, revert, rollback, format, reboot, shutdown, eject, detach, evict, clear, clean, flush, abort. Catches git_checkout, push_files, merge_pull_request, fork_repository which were all false negatives.

3. Parameter-based danger analysis
Parses inputSchema.properties for dangerous parameter names (path, command, sql, url, webhook) and dangerous description patterns. Unconstrained string params (no enum/pattern/maxLength) are upgraded to high risk. Detects that read_file with a path param is dangerous even though "read" is a safe verb.

4. HTTP transport proxy (mcp-http-proxy)
New binary for HTTP/SSE MCP servers (Notion, Linear, Atlassian, Figma, Roboflow, DeepWiki). Intercepts tools/list and tools/call over HTTP. Handles both JSON and SSE streaming. Supports --strict and --auto-update modes. Health check endpoint at GET /health.

5. Config file secret scanning (scan-config)
New subcommand: mcp-trustcard scan-config . Scans MCP config files for exposed secrets — GitHub tokens, OpenAI keys, Slack tokens, AWS keys, Google keys, Bearer tokens, JWTs, and generic key-value patterns. Redacts secrets in output. Found 2 real secrets in the production config during testing.

6. Secret redaction in both proxies
All stderr logs in both mcp-proxy and mcp-http-proxy are redacted via lib/redact.js. Server stderr passthrough is redacted. Prevents secret leakage in debug output, crash logs, or piped telemetry. Covers GitHub, OpenAI, Slack, AWS, Google, Bearer, JWT, and generic key-value patterns.

GitHub Action

New scan-config input for the GitHub Action:

- uses: davidnichols-ops/trustcard@v0.4.0
  with:
    scan-config: .devin/config.json  # scan for exposed secrets

Or server scan mode (unchanged):

- uses: davidnichols-ops/trustcard@v0.4.0
  with:
    server: @modelcontextprotocol/server-github
    min-score: 50
    save-manifest: manifest.json

Stats

• 49 tests, all passing (19 new tests for checks, 10 new for HTTP proxy, 20 existing)
• 14 files in npm package, 31.3 kB packed
• Zero dependencies — pure Node stdlib
• node >= 18 required

v1.0.0 — MCP Trustcard

MCP Trustcard v1.0.0

The "npm audit" for MCP servers. A trust card for every Model Context Protocol server — before you connect.

What's included

Scorecard — 8 checks, 100 points:

• Installability (npm resolution)
• Protocol handshake (initialize + tools/list)
• Tool schema validity
• Destructive tool detection
• Auth posture
• Secret exposure
• Protocol version
• Latency / failure rate

Call-time enforcement proxy (mcp-proxy):

• Scan generates a manifest (tool names + SHA-256 schema hashes)
• Proxy sits between client and server, strips unapproved tools from tools/list
• Blocks calls to tools not in the manifest before they reach the server
• Logs schema drift
• Client-agnostic — works with any stdio MCP client, no client-side changes

GitHub Action — drop into CI:

- uses: davidnichols-ops/trustcard@v1
  with:
    server: @modelcontextprotocol/server-github
    min-score: "50"
    save-manifest: manifests/github.json

Leaderboard

Scanned 2026-07-14 with npx -y <pkg> (no args, no env):

Server	Score	Handshake
@modelcontextprotocol/server-filesystem	87/100	PASS
@playwright/mcp	87/100	PASS
@modelcontextprotocol/server-github	86/100	PASS
@modelcontextprotocol/server-memory	83/100	PASS
@modelcontextprotocol/server-git	82/100	PASS
@modelcontextprotocol/server-fetch	81/100	PASS
@modelcontextprotocol/server-time	79/100	PASS
@modelcontextprotocol/server-sqlite	79/100	PASS
@modelcontextprotocol/server-brave-search	26/100	FAIL
@modelcontextprotocol/server-puppeteer	26/100	FAIL

Install

npx -y mcp-trustcard@latest @modelcontextprotocol/server-github