TrustScan

Tools

Token cost is the o200k count of the tools list JSON, including schemas, before any tool is called.

• trust_scan_server

  Security-scan an MCP server or skill package before trusting it. Runs all four checks — invisible Unicode prompt-injection, dangerous code patterns (MCP001–006), hardcoded secrets, typosquat package

• trust_scan_file

  Security-scan a single file for invisible Unicode, dangerous patterns, and secrets. Returns a severity-weighted score and per-finding detail (rule, severity, location). Read-only: the file is never m

• skills_list_tool

  List this product's skills. Each entry carries the SKILL.md URI, its name and description, verbatim frontmatter, and a per-file sha256 manifest. Read a body with `read_skill`.

• read_skill

  Read a product skill file by its skill:// URI.