LaunchTrust

co.launchtrustPublished by launchtrust.coOfficial publisherv0.1.0Updated Oct 24, 2026

Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

LaunchTrust scans public web URLs for security and compliance issues and tracks registered apps' scans, findings and signed evidence records.

What you can do
Run a free quick-scan of a public URL for leaked frontend secrets, exposed .env or .git files, security headers, HTTPS/HSTS, missing privacy or terms pages, trackers and AI-interaction disclosure, and verify signed scan records against the published public key. Look up the jurisdictions and categories it tracks and fetch sourced compliance rule snapshots, optionally filtered by jurisdiction code. List apps registered in your LaunchTrust account with their latest scan status, and register a URL so it can be fully scanned and monitored. Run full scans on registered apps, review recent scan history with findings, and get a market report annotating findings with the rules applicable to the app's
When to use it
Use it when you want a quick security and compliance check on a public site, need to look up which privacy or AI rules apply in a given jurisdiction, or want to monitor registered apps and keep signed evidence of their scan results.
Requirements
A remote endpoint; no local runtime, package or declared authentication is needed for the public tools. The account tools (listing apps, registering a URL, full scans, scan history, market report) require a LaunchTrust token, and registering and scanning apps also require an active subscription.
Before you install
Account tools need a LaunchTrust token, and registering or scanning apps requires a paid subscription and is limited to 5 scans per app per day. Full scans store signed, dated evidence records in your account. Results are described as a compliance aid, not legal advice, and the quick-scan returns only a subset of checks.

Installation

In SourceWeft

  1. Open LaunchTrust in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/co.launchtrust%2Flaunchtrust/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "launchtrust": {
      "type": "http",
      "url": "https://mcp.launchtrust.co/mcp"
    }
  }
}

README

This repository has no README.

Tools

9

scan_url

Free compliance + security quick-scan

Run a FREE LaunchTrust compliance + security quick-scan on a public web URL. Returns a focused SUBSET of checks — leaked frontend secrets/API keys, exposed .env//.git, security headers, HTTPS/HSTS, missing privacy/terms pages, trackers/cookie banner, and AI-interaction disclosure. The result is unsigned and not stored. The full 27-detector signed, dated, continuously-monitored scan requires a LaunchTrust account. Compliance aid, not legal advice.

Parametersurlrequired

list_jurisdictions

List compliance jurisdictions covered

List the jurisdictions and categories LaunchTrust tracks (e.g. EU AI Act, GDPR, US state privacy laws, app-store policies). Public coverage registry. Compliance aid, not legal advice.

Takes no parameters.

get_compliance_rules

Get sourced compliance rule snapshots

Fetch LaunchTrust's sourced, founder-reviewed compliance rule snapshots, optionally filtered to one jurisdiction code (e.g. eu-ai-act-50, gdpr, ca-sb243). Compliance aid, not legal advice.

Parametersjurisdiction

verify_record

Verify a LaunchTrust signed record

Independently verify the ECDSA (ES256) signature on a LaunchTrust signed scan/disclosure record against the published public key. Pass the record JSON (the downloaded record, or an object containing `canonical` and `signature`).

Parametersrecordrequired

list_my_apps

List your registered apps

List the apps registered in your LaunchTrust account, with each one's latest scan status. Requires a LaunchTrust token.

Takes no parameters.

register_app

Register an app to monitor

Register a web URL in your LaunchTrust account so it can be fully scanned and monitored. Idempotent — if the URL is already registered, returns the existing app. Requires a LaunchTrust token and an active subscription.

Parametersurlrequiredname

scan_app

Run a full signed scan on a registered app

Run the full LaunchTrust scan on one of your registered apps and store a signed, dated evidence record. Requires a LaunchTrust token and an active subscription. Limited to 5 scans per app per day.

Parametersapp_idrequired

get_scan_history

Get scan history for an app

List recent scans (summary + findings) for one of your registered apps. Requires a LaunchTrust token.

Parametersapp_idrequired

get_market_report

Get a market-annotated compliance report

Get the latest scan for one of your registered apps, with each finding annotated by the jurisdictions and rules applicable to that app's target markets. Requires a LaunchTrust token.

Parametersapp_idrequired

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.