Introducing the Free Online MCP Scanner: npm, PyPI, GitHub, Remote Endpoints and Whole Configs

Today the free online MCP scanner goes live on mcptrustchecker.com. Paste an npm or PyPI package name — or a GitHub repository — and a few seconds later you are looking at a deterministic A–F Trust Score computed from the server's real source: every finding listed with its evidence, the capability blast radius next to it, and an honest statement of how much of the package the scan could actually read.

It goes further than packages: scan a live remote endpoint (OAuth sign-in supported), paste a tools.json manifest, or drop in your entire client config — and every server in it gets graded at once. No signup. No API key. Nothing to install. And every result is a link you can share, with a live Trust Score badge you can drop into a README.

Why an online scanner at all?

The right moment to check an MCP server is before it touches your machine — before npx runs its install scripts, before its tools appear in your assistant's context. The CLI already does this offline, and the free API does it over HTTPS, but both assume you are already at a terminal. The online scanner removes the last bit of friction: anyone evaluating a server — a developer skimming a README, a security reviewer triaging a request, a team lead deciding what to allow — can get the full verdict from a browser tab.

That matters because the things the scanner looks for are precisely the things a human skimming a repo cannot see: tool poisoning hidden in tool descriptions, hidden-Unicode payloads, cross-tool toxic flows that assemble a data-exfiltration primitive, embedded secrets, and supply-chain red flags.

What you can scan

Six inputs, one engine:

• npm packages — scoped or not, with optional @version pinning. The engine fetches the published artifact, verifies it against the registry-declared hash, and reads the exact bytes you would install.
• PyPI packages — same deal for the Python ecosystem: the sdist or wheel is resolved, hash-verified and read in memory.
• GitHub repositories — enter owner/repo or paste any github.com URL and the scanner downloads the default branch and analyzes its source. This is the answer for MCP servers that are pre-release, source-only, or simply not published to a package registry yet.
• tools.json manifests — paste a raw tool surface (a tools/list result or a hand-written manifest) and get it graded, no package required.
• Live remote endpoints — paste an https Streamable-HTTP or SSE URL and the scanner connects to the running server, including servers behind OAuth (more on this below).
• Your whole client config — paste claude_desktop_config.json, .cursor/mcp.json or .vscode/mcp.json and every server in it gets graded at once (more on this below).

You do not have to think about which one you are holding: paste a full npmjs.com, pypi.org or github.com URL into the field and the scanner recognizes the source, selects it, and normalizes the input for you.

Audit your whole config in one paste

This is the launch feature we are proudest of, and — as far as we can tell from checking every online MCP scanner on the market — no other online scanner accepts either of these inputs: competitors take a GitHub URL, sometimes a package name, and stop there.

Your client config is your MCP attack surface. Every entry in mcpServers is code that runs on your machine and talks to your assistant. So the scanner treats the config as the unit of audit: paste the whole file, and each entry is resolved to its published package (npx … → npm, uvx … → PyPI), scanned with the full engine, and graded individually. You get a summary table — every server, its grade, its capability blast radius, and a link to the full findings — plus the worst grade called out on top, because that is the one that matters.

Remote endpoints and Docker images in the config are listed honestly as not-scannable-online (fetching caller-supplied URLs is an SSRF vector the hosted scanner deliberately refuses); the CLI covers those locally. Your pasted config is parsed in the browser first and nothing is stored.

What a result shows

A scan result is the same report the MCP Trust Registry shows for its listed servers, generated on demand:

• Trust grade and score — the A–F verdict with the 0–100 score behind it, and a "why this grade" breakdown that itemizes every deduction. No black box: each point lost is traceable to a rule and its evidence.
• Capability — the blast radius if the server went rogue, scored independently of trust. A browser driver is powerful but not suspicious; the two axes never get conflated.
• Coverage — how much the scan could actually inspect. Shallow coverage is stated, never hidden.
• Findings with evidence — every detection with severity, the rule that fired, the matched evidence, and a suggested fix.
• The tool surface — each tool the server exposes and what it can reach.

Remote servers — including the ones behind a login

The fastest-growing way to ship an MCP server is not to ship it at all: you host it and hand out a URL. Claude connectors and ChatGPT apps are remote-only. There is no package to download and no repository to read — which is precisely why most scanners stop at the door.

Paste the endpoint into the Remote endpoint tab and the scanner connects to the running server over Streamable-HTTP (with SSE fallback), enumerates its real tools, prompts and resources, and grades that surface: tool poisoning, capability blast radius, cross-tool toxic flows.

And if the server requires authorization, it does the full OAuth flow — protected-resource discovery, dynamic client registration, PKCE, resource indicators — then hands you a sign-in link. You authorize with the provider, come back, and the scan runs against your authorized tool surface. The access token lives in memory for that one scan: never written to a database, never logged, never returned to the browser. Servers that use a plain static API key are supported too.

Two things we are deliberately strict about. Fetching a user-supplied URL is a textbook SSRF primitive, so the scanner accepts https only, refuses URLs with embedded credentials, and requires the host to still be public after DNS resolution — a perfectly ordinary-looking hostname that resolves to 127.0.0.1 or a cloud metadata address is rejected, and every redirect and OAuth-discovery hop is re-checked. And a live scan reads only what the wire exposes, so its coverage is reported as “live”: it is an honest read of the tool surface, not the source-level verdict a package scan gives you. The result panel says so on its face rather than letting a clean-looking A imply more than it should.

Share it. Badge it.

Every scan result lives at a stable URL and carries a one-click share to X, LinkedIn or Reddit — and when the link unfurls, it renders a custom Open Graph card showing that server's actual grade, not a generic logo. A claim like "this server scores an F" travels with its receipts one tap away.

There is also a live Trust Score badge for every scanned target — Markdown and HTML snippets are right on the result page. The badge is computed live, so it stays current, and it works even for servers that are not listed in the registry. Maintainers: put it in your README and let users verify rather than trust.

Optionally: add it to the registry

If the server you scanned deserves a permanent, crawlable home, tick "Add this server to the public MCP Trust Registry", pick a category, and publish. Two honest caveats: the registry indexes released npm/PyPI packages (a raw GitHub repo can't be listed until it ships as a package), and your browser's scan is never trusted for the listing — the server re-scans the package authoritatively before the entry goes live, so nobody can submit a forged grade.

A genuinely unique algorithm: deterministic, zero AI

Here is what actually separates this scanner from everything else on the market. Every other online MCP scanner we surveyed builds its verdict on an LLM: one runs a proprietary AI classifier over tool descriptions, another asks five different LLMs to vote, a third cross-validates findings between three AI agents. That approach has a structural problem — the same server can get a different verdict tomorrow, nobody can explain exactly why a score is what it is, and the judge itself is susceptible to the very prompt-injection tricks it is supposed to catch.

MCP Trust Checker took the opposite bet. The Capability-Flow Trust Model is an original, versioned methodology built from scratch for MCP — currently mcptrustchecker-1.9, calibrated against a corpus of more than 30,000 scanned MCP servers and audited for false positives and false negatives before every release. There is no LLM anywhere in the scan path: named rules, a cross-tool toxic-flow graph, and a scoring model where every deducted point is traceable to a rule and its evidence. The same input always yields the same grade, and every grade can be reproduced byte-for-byte from the public source. As far as we know, it is the only online MCP scanner that can make that claim.

The online scanner is not a lightweight preview of the "real" tool — it is the real tool: the same engine powers the CLI, the API, the registry and this page.

It is also built defensively: repository downloads are size-capped and streamed, nothing from a scanned package is ever executed, working copies are deleted after every scan, and rate limits keep the service healthy for everyone.

One engine, three ways to run it

• Online — mcptrustchecker.com/scan: packages, repos, live endpoints, manifests and whole configs. Nothing to install.
• CLI — npx mcptrustchecker@latest <package> --online, fully offline-capable, ideal for CI gates.
• API — GET /api/v1/scan/npm/…, /scan/pypi/…, /scan/github/{owner}/{repo} and POST /scan/remote, free key issued instantly.

Go scan the next MCP server you are about to install — it takes ten seconds, and it is free.

npx mcptrustchecker