Open-source · runs offline

Inspect before
you connect

Every MCP server can read your files, call your APIs, and run commands on your behalf. Check what it actually does before your agent installs it.

$ npx mcp-customs scan .

Inspection report

payments-mcp-server

Flagged

score 9 / 100 — 2 files scanned

CRITMCP001 — shell interpolation in execSync()

CRITMCP005 — hidden instruction in tool description

HIGHMCP004 — hardcoded Stripe key in server.js:22

Check a server

Currently a manually-maintained list of 12 servers from the initial launch scan — not yet a live, automatic database. Run the CLI yourself for anything not listed here.

Recently inspected

Server	Score	Stamp	Inspected

How it works

Scan locally

Run the CLI against any MCP server. Nothing leaves your machine — checks run fully offline.

Publish the result

Optionally push your report to the public registry so others can look up the server before they install it too.

Badge your repo

Maintainers add the trust badge to their README. Anyone browsing the repo sees the score before they ever run the install command.

Add it to CI

- run: npx mcp-customs scan . --sarif results.sarif --fail-on high
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Inspect beforeyou connect