trustlists

io.github.trustlistsPublished by GitHub account trustlistsv0.3.0Updated Oct 31, 2026

Find public vendor trust centers, analyze SOC 2 reports, and request trust-center access.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Searches a public directory of vendor trust centers, maps project dependencies to them, and, when signed in, analyzes SOC 2 PDFs and files access requests.

What you can do
  • Search, look up and browse public vendor trust centers by name, domain, platform, listed framework or CSA STAR level
  • Map project manifests (npm, Python, Go, Rust, Ruby, PHP) to public vendor trust centers
  • Sign in with a device code and check the current session
  • Analyze local SOC 2 PDFs with preview, status and report steps
  • Fill in a requester profile and send SafeBase or Vanta access requests, individually or in batches of up to five vendors
When to use it
Useful when you need to check which vendors in a project's dependency list publish a trust center, or when you want an assistant to look up a vendor's listed compliance frameworks and request access to its trust center documents.
Requirements
Runs as a local stdio process, normally spawned by the MCP client via npx, so Node.js is needed. The search, lookup, browse and dependency-audit tools need no account. Account tools require device-code sign-in, with credentials stored in a local auth file on the machine; a hosted endpoint variant uses OAuth sign-in instead. Network access to the trustlists service is required.
Before you install
Signing in stores session credentials in a local file on the machine. SOC 2 analysis consumes credits and requires an explicit confirmation step; access requests also need confirmation before sending. Access requests submit your requester profile to third-party vendors. Directory labels reflect what a public record lists and do not prove certification scope, validity or security quality.

Installation

In SourceWeft

  1. Open trustlists in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@trustlists/mcp

MCP server that gives AI assistants access to the public trustlists directory, plus signed-in SOC 2 analysis and trust-center access requests.

This npm package powers the trustlists_ plugin for Cursor, Claude Code, and other Model Context Protocol clients.

Installation

You don't install this package directly. It is spawned by your MCP-aware AI client.

Cursor

The trustlists_ plugin handles installation. Or add it manually to ~/.cursor/mcp.json:

json
{  "mcpServers": {    "trustlists": {      "command": "npx",      "args": ["-y", "@trustlists/mcp"]    }  }}

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "trustlists": {      "command": "npx",      "args": ["-y", "@trustlists/mcp"]    }  }}

Tools

Free (no account)

ToolDescription
trustlists_searchSearch thousands of trust centers by name or domain
trustlists_lookupLook up a single vendor by exact domain
trustlists_browseFilter by platform, listed framework, or CSA STAR level
trustlists_audit_dependenciesMap project manifests to public vendor trust centers

Account

Sign in with trustlists_login (device code). Credentials are stored in ~/.trustlists/auth.json on this machine. The hosted endpoint at mcp.trustlists.org/mcp serves these tools after an OAuth sign-in instead, with SOC 2 uploads in the trustlists app (trustlists_soc2_upload) in place of local PDF paths.

ToolDescription
trustlists_login / logout / whoamiDevice-code sign-in and session
trustlists_soc2_analyze / status / reportAnalyze local SOC 2 PDFs (preview, then confirmCredits)
trustlists_requester_profileIdentity used on vendor access forms
trustlists_access_request / status / continueRequest SafeBase/Vanta access (preview, then confirm)
trustlists_access_request_batchSame, up to 5 vendors, one confirm

Directory labels show what a public record lists. They do not independently prove certification scope, validity, legal compliance, or security quality.

Supported manifest formats (audit tool)

  • package.json (npm/yarn/pnpm)
  • requirements.txt, pyproject.toml, Pipfile (Python)
  • go.mod (Go)
  • Cargo.toml (Rust)
  • Gemfile (Ruby)
  • composer.json (PHP)

License

Apache 2.0. See LICENSE and NOTICE.

Links

Source: packages/mcp/README.md at commit 7b6665f

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.3.0LatestOct 3, 2026
  2. v0.2.1Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts