Mcp Shield

com.craftedtrustPublished by craftedtrust.comOfficial publisherv2.0.0Updated Oct 24, 2026

Trust verification for MCP servers. Check scores, scan for security issues, search 4,200+ servers.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server that lets an assistant look up trust scores, run security scans, and search a registry of MCP servers before connecting to them.

What you can do
Look up a trust score, grade, findings summary and certification status for an MCP server by URL or npm package name, and trigger a live trust scan of an HTTP or HTTPS server that returns score, grade and security findings. Search the CraftedTrust registry overlay of indexed MCP packages and servers, filtering by grade, certification or scan type. Retrieve ecosystem statistics such as total indexed servers, live verified count, average trust scores and flagged count.
When to use it
Useful when an agent or developer wants to vet an unfamiliar MCP server before connecting, or to compare indexed servers by trust grade and certification. Also handy for a quick overview of the ecosystem's overall trust statistics.
Requirements
A remote endpoint reached over streamable HTTP; no packages, environment variables or headers are declared. The README's configuration example points to a different path than the manifest endpoint, so confirm the correct URL. Network access to the service is required.
Before you install
The README lists two additional tools, pay_for_certification and verify_payment, that initiate and verify a USDC certification payment; the manifest lists only four tools, so payment behavior is unconfirmed. Scores and grades are third-party assessments, not guarantees. The server receives the URLs or package names you look up.

Installation

In SourceWeft

  1. Open Mcp Shield in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.craftedtrust%2Fmcp-shield/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "shield": {
      "type": "http",
      "url": "https://mcp.craftedtrust.com/api/v1/mcp"
    }
  }
}

README

Trust-Gated Agent Examples

Reference implementations showing how to make AI agents check CraftedTrust before connecting to any MCP server. If a server scores D or F, the agent refuses to connect.

This is the "SSL certificate check for AI agents" pattern.

Quick Start

Add CraftedTrust to your agent's MCP config:

json
{  "mcpServers": {    "craftedtrust": {      "url": "https://mcp.craftedtrust.com/api/v1/mcp",      "description": "Check trust scores before connecting to MCP servers"    }  }}

Your agent now has access to 6 tools:

ToolDescription
check_trustLook up trust score by URL or npm name
scan_serverTrigger a live security scan
search_registrySearch 4,200+ indexed MCP servers
get_statsEcosystem statistics
pay_for_certificationInitiate USDC certification payment
verify_paymentVerify on-chain payment

The Pattern

Before your agent connects to any new MCP server:

  1. Call check_trust on CraftedTrust
  2. If grade is D or F, refuse and explain why
  3. If grade is A/B/C, proceed with the connection

Examples

Python (LangGraph)

See python/trust_gated_agent.py for a complete LangGraph agent that gates MCP connections through CraftedTrust.

bash
cd pythonpip install -r requirements.txtpython trust_gated_agent.py

TypeScript (MCP Client)

See typescript/trust-gated-client.ts for a TypeScript MCP client that checks trust scores before connecting.

bash
cd typescriptnpm installnpx tsx trust-gated-client.ts

How It Works

Agent receives task → needs mcp.example.com         ↓Agent calls CraftedTrust check_trust("mcp.example.com")         ↓Score: 82/100, Grade: B ← Safe         ↓Agent connects to mcp.example.com ✓
Agent receives task → needs sketchy-server.xyz         ↓Agent calls CraftedTrust check_trust("sketchy-server.xyz")         ↓Score: 15/100, Grade: F ← Dangerous         ↓Agent refuses: "Server scored F (15/100). Not connecting." ✗

Trust Score Grades

GradeScoreMeaning
A90-100Excellent security practices
B75-89Good security, minor improvements possible
C60-74Adequate but has gaps
D40-59Significant security issues
F0-39Critical issues, do not connect

API Reference

Full API documentation: mcp.craftedtrust.com/api-docs.html

License

MIT

Built by Cyber Craft Solutions LLC

Source: README.md at commit 097318b

Tools

4

check_trust

Look up the trust score for any MCP server by URL or npm package name. Returns score, grade, findings summary, and certification status.

Parametersnpm_nameserver_url

scan_server

Trigger a live trust scan of an HTTP or HTTPS MCP server. Returns trust score, grade, and security findings.

Parametersserver_urlrequired

search_registry

Search the CraftedTrust registry overlay for indexed MCP packages and servers. Filter by grade, certification, or scan type.

Parametersgradelimitqueryrequiredcertifiedscan_type

get_stats

Get CraftedTrust ecosystem statistics: total indexed servers, live verified count, average trust scores, flagged count, and more.

Takes no parameters.

Version history

1
  1. v2.0.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts