mcpcheck

Check if an MCP server is safe to install: returns a trust score (0-100, grade A-F). Accepts a registry name (io.github.x/y), a GitHub repo (owner/repo), or a remote MCP URL. For remote servers it live-connects and analyzes the actual exposed tools for tool-poisoning + capabilities, and checks the backing repo (maintenance, license, security policy, auth). Call BEFORE installing or recommending any MCP server.

{'type': 'object', 'required': ['target'], 'properties': {'target': {'type': 'string', 'description': 'Registry name (io.github.x/y), GitHub repo (owner/repo), or remote MCP URL (https://...).'}}}

Scan and inspect an MCP server for security issues before connecting it: live tool-poisoning analysis, exposed-tool inventory + capabilities, TLS, and repo trust signals. Same engine as check_mcp_trust. Accepts a registry name, GitHub repo, or remote MCP URL.

{'type': 'object', 'required': ['target'], 'properties': {'target': {'type': 'string', 'description': 'Registry name (io.github.x/y), GitHub repo (owner/repo), or remote MCP URL (https://...).'}}}