Tooltrust Scanner, developed by Agentsafe AI, is a security scanner designed for AI agent tool definitions on the mcp platform. Built with Go, it functions as an MCP server tool, offering static security analysis for Model Context Protocol assets. It can extract tool definitions from live MCP servers or local JSON files, available as an npm package, Go module, or CLI script. This program helps developers and security professionals assess the trust grade of AI agent tools, enhancing pre-deployment security and enabling agent self-auditing within CI/CD pipelines. Its compatibility with major AI clients underscores its practical utility.

What does Tooltrust Scanner connect to?

Tooltrust Scanner connects to live Model Context Protocol (MCP) servers to extract AI agent tool definitions. It can also read tool definitions directly from local JSON files. Operating as an MCP server itself, it is categorized as a static security scanner for MCP tool definitions. The scanner supports stdio transport when acting as an MCP server, meaning it runs as a subprocess without needing a network listener. This design enables it to integrate directly with host systems for security analysis.

Core features and tools

When running as an MCP server, Tooltrust Scanner exposes two callable tools to an AI agent. The tooltrust_scan_config tool scans all MCP servers defined in the agent's .mcp.json or ~/.claude.json configuration files. The tooltrust_scan_server tool specifically scans a single, designated MCP server. These tools enable agents to initiate security audits of their own defined tools or specific server endpoints.

Who is it for?

Tooltrust Scanner is intended for developers and security professionals working with AI agents and Model Context Protocol (MCP) servers. Its capabilities support those focused on ensuring the integrity and safety of AI agent operations before and during deployment. It provides mechanisms for evaluating the trustworthiness of agent tools and integrating security into development workflows. Skip this if you are not involved with AI agent tool definitions or MCP servers.

How to get started

No credentials are required. The stdio transport mode relies on the host system's process execution, as it runs as a subprocess without an explicit internal authentication mechanism.

Use cases

• Pre-deployment security scanning: Assigning trust grades (A–F) to AI agent tools before they are called.
• Agent self-auditing: Allowing an AI agent to audit its own tools by executing tooltrust_scan_config to generate a risk report.
• CI/CD integration: Functioning as a security check within continuous integration pipelines.

Tooltrust Scanner provides essential security analysis for AI agent tool definitions, functioning as a static scanner for MCP servers. Its ability to assign trust grades and integrate into CI/CD workflows makes it a valuable asset for securing AI agent deployments. Compatible with popular AI clients, it supports critical pre-deployment and self-auditing security checks. Start by configuring your agent's MCP servers to execute "npx -y tooltrust-mcp" for immediate scanning.