v1.0.0 — MCP Trustcard

MCP Trustcard v1.0.0

The "npm audit" for MCP servers. A trust card for every Model Context Protocol server — before you connect.

What's included

Scorecard — 8 checks, 100 points:

• Installability (npm resolution)
• Protocol handshake (initialize + tools/list)
• Tool schema validity
• Destructive tool detection
• Auth posture
• Secret exposure
• Protocol version
• Latency / failure rate

Call-time enforcement proxy (mcp-proxy):

• Scan generates a manifest (tool names + SHA-256 schema hashes)
• Proxy sits between client and server, strips unapproved tools from tools/list
• Blocks calls to tools not in the manifest before they reach the server
• Logs schema drift
• Client-agnostic — works with any stdio MCP client, no client-side changes

GitHub Action — drop into CI:

- uses: davidnichols-ops/trustcard@v1
  with:
    server: @modelcontextprotocol/server-github
    min-score: "50"
    save-manifest: manifests/github.json

Leaderboard

Scanned 2026-07-14 with npx -y <pkg> (no args, no env):

Server	Score	Handshake
@modelcontextprotocol/server-filesystem	87/100	PASS
@playwright/mcp	87/100	PASS
@modelcontextprotocol/server-github	86/100	PASS
@modelcontextprotocol/server-memory	83/100	PASS
@modelcontextprotocol/server-git	82/100	PASS
@modelcontextprotocol/server-fetch	81/100	PASS
@modelcontextprotocol/server-time	79/100	PASS
@modelcontextprotocol/server-sqlite	79/100	PASS
@modelcontextprotocol/server-brave-search	26/100	FAIL
@modelcontextprotocol/server-puppeteer	26/100	FAIL

Install

npx -y mcp-trustcard@latest @modelcontextprotocol/server-github