MCPLookup

com.mcplookupPublished by mcplookup.comOfficial publisherv0.1.6Updated Oct 25, 2026

Look up independent trust ratings and security, maintenance, and adoption evidence for MCP servers.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A read-only lookup service that lets an assistant find MCP servers and check independent trust ratings, security, maintenance and adoption evidence for them.

What you can do
Resolve a server name, vendor, package, repository, registry identifier or endpoint to a canonical MCPLookup identity, with up to five reviewed candidates and connection options. Find servers for a task or capability by free text or a normalized capability taxonomy, with optional filters. Look up the full trust record for one exact server name: verdict, Trust Index band and score with confidence, safety, maintenance, adoption and provenance bands, coverage, freshness, public evidence and citation.
When to use it
Useful when choosing which MCP server to install, when you have a name or package and want to confirm what it actually is, or when you need a trust, security or maintenance assessment before connecting.
Requirements
Either a remote Streamable HTTP endpoint or the local npm package run with npx, which needs Node.js 20 or newer. No API key, environment variable or header is required. Network access to the hosted service is needed.
Before you install
All three tools are read-only and anonymous, and the wrapper stores no credentials or local data. Requests go to MCPLookup's hosted endpoint, where bounded security and product telemetry are processed under its privacy policy. The MIT license covers only the wrapper software, not the hosted evidence, scores or taxonomy, whose use is governed by MCPLookup's terms.

Installation

In SourceWeft

  1. Open MCPLookup in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.mcplookup%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "mcplookup": {
      "type": "http",
      "url": "https://mcplookup.com/mcp"
    }
  }
}

README

MCPLookup MCP

[npm] [tests] [license] [MCPLookup Trust Index: gold, 89 out of 100]

The official stdio compatibility wrapper for the MCPLookup remote MCP server—the independent trust layer for MCP.

The canonical server is https://mcplookup.com/mcp. It provides three anonymous, read-only tools:

  • resolve_server resolves a title, package, endpoint, or name to a canonical server.
  • find_servers finds up to five servers using MCPLookup's normalized taxonomy.
  • trust_lookup returns the current Trust Index, verdict, evidence, and citation.

This package exists for MCP clients that require a local stdio command. It forwards MCP messages to the canonical hosted server without implementing scoring, storing evidence, adding authentication, or changing tool results.

Connect

Connect directly when your client supports remote Streamable HTTP:

text
https://mcplookup.com/mcp

Use this package when your client requires a local stdio command:

Node.js 20 or newer is required. No API key or environment variable is needed.

bash
npx -y @mcplookup/mcp

Generic MCP client configuration:

json
{  "mcpServers": {    "mcplookup": {      "command": "npx",      "args": ["-y", "@mcplookup/mcp"]    }  }}

Prefer a direct Streamable HTTP connection to https://mcplookup.com/mcp when your client supports remote MCP servers. The package is a transport adapter, not a separate service.

MCP Registry

MCPLookup is listed in the official MCP Registry as com.mcplookup/mcp. The name is verified through DNS control of mcplookup.com.

One entry covers both connection paths, so a client installing from the Registry can use whichever it supports:

PathDeclaration
Canonical remotestreamable-http → https://mcplookup.com/mcp
Compatibility packagenpm @mcplookup/mcp, stdio transport

The entry declares no environment variables, headers, or credentials, matching the anonymous public interface. server.json in this repository is the source of that metadata.

What stays remote

The wrapper contains no trust scores, evidence database, taxonomy, authentication system, or scoring logic. MCPLookup evaluates public evidence at the canonical service and returns the same bounded, current-state response whether a client connects directly or through this stdio adapter.

The MIT license covers the plugin and wrapper software in this repository only. It does not license MCPLookup's hosted evidence database, assessments, verdicts, scores, classifications, taxonomy, historical record, or scoring framework. Use of service data remains governed by the MCPLookup terms.

Data and security

The wrapper has no credentials and writes no local data. Requests are sent to MCPLookup's hosted endpoint, where bounded security and product telemetry are processed under the MCPLookup privacy policy. See the MCP documentation for the public interface contract.

Report security issues according to SECURITY.md. For product support, email [email protected].

Bug reports and narrowly scoped compatibility improvements are welcome. See CONTRIBUTING.md before opening a pull request.

Development

bash
npm testnpm pack --dry-run

The package intentionally has zero runtime dependencies.

Marketplace package

This repository also contains the shared MCPLookup marketplace package:

  • .claude-plugin/plugin.json and .mcp.json package the remote server for Claude.
  • .codex-plugin/plugin.json packages the same remote server for ChatGPT and Codex.
  • skills/verify-mcp-server/SKILL.md adds the proactive pre-connect verification workflow.
  • review/marketplace-cases.md defines the positive, negative, and direct-connect release cases.

The skill improves orchestration but is not required for correct tool selection. Direct MCP, Registry, npm-wrapper, and VS Code clients receive independently useful tool descriptions and server instructions from the canonical hosted service.

Source: README.md at commit 1d0af27

Tools

3

resolve_server

Resolve an MCP server

Resolve a named MCP server, vendor, product, package, repository, Registry identifier, or endpoint to a canonical MCPLookup identity. Returns at most five reviewed candidates with query-relative identity and publisher explanations, a compact trust assessment, and current connection options. This is the best fit when a particular artifact or product is known; find_servers covers open-ended capability discovery, while trust_lookup returns the full current evidence record for an exact canonical name.

Parametersidentifierrequired

find_servers

Find MCP servers

Find a compact, trust-aware shortlist for a task or capability when no particular MCP server or product is known. Search by free text or MCPLookup's normalized capability taxonomy, with optional filters. Free text returns a reviewed identity-only slate when available; otherwise results are explicitly labelled catalog matches, and the two evidence lanes are never mixed. Returns at most five results with no pagination. A selected exact server name can be passed to resolve_server for reviewed identity context and connection options; named artifacts fit resolve_server directly.

Parameterskindlimitqueryindustryorder_bycapability

trust_lookup

MCPLookup trust lookup

Return MCPLookup's complete current trust record for one exact canonical MCP server name. Includes the verdict, Trust Index band and 0–100 score with confidence, coarse safety, maintenance, adoption, and provenance bands, coverage, freshness, public evidence, and citation. This fits trust questions and evidence review after identity is known; resolve_server handles ambiguous names or coordinates. Current state only—no history or safety certification.

Parametersserver_namerequired

Version history

1
  1. v0.1.6LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts