Skip to content
mcp/harbor

mcp-trust changelog

io.github.saagpatel/mcp-trust

2 changes recorded. MCP Harbor re-reads this listing from the official registry every six hours and asks the live server what it exposes, and keeps what changed between one look and the next.

  • AGENTS.md +90 −111

    https://raw.githubusercontent.com/saagpatel/mcp-trust/HEAD/AGENTS.md 

    − # AGENTS.md — MCP Trust Registry− ## Project Summary− MCP Trust Registry is a neutral public trust registry for MCP servers. Its product− loop is "check before you connect": register public MCP servers, scan them with a− pluggable engine, normalize the results into an A-F danger grade plus transparency− signal, persist the record, and serve it through a public API, web catalog, and− README badge endpoint.− This repo is not trying to win by being another scanner. The scanner is a− replaceable backend; the durable layer is the public catalog, stable lookup API,− trust-grade normalization, and author badge distribution loop. The current real− engine adapter wraps `mcp-audits`, while the default `StubEngine` keeps the full− system testable without launching untrusted code.− ## Current State− The MVP is built and tested end to end: seed catalog, scan, grade, persist,− serve JSON and web views, and emit shields.io-compatible badge JSON. The− repository is public. Treat anything committed here, and anything written in an− issue or pull request, as published the moment it lands. The product itself is− pre-launch. The seed catalog now contains official reference− MCP servers for launch calibration. Product launch is gated by validating− sandboxed real-engine scans, inspecting the grade distribution, deciding whether− to broaden beyond reference servers, deploying the FastAPI app with persistent− SQLite storage, and smoke-testing the badge loop against the public base URL.− ## Stack− - Python 3.11, pinned by `.python-version` so `uv venv` and `uv run` match CI− - FastAPI and Uvicorn for the API/web surface− - Typer for the CLI− - Pydantic domain models− - SQLite persistence− - Pytest and Ruff for local verification− - Optional `mcp-audits` engine extra for real MCP-server scanning− ## How To Run− Use the README's [Quickstart](README.md#quickstart) for an isolated stub demo and− [local development and verification](README.md#local-development-and-verification)− for frozen core/dev setup, focused and broader pytest checks, Ruff, packaging,− and conditional browser preview. `.python-version` pins the CI interpreter;− keep it and `uv.lock`. The routine verification path does not install the engine− extra or opt into real-server/Docker tests.− Real scans, qualification, refresh, and launch are separate operator workflows:− follow the [operator runbook](docs/GRADE-REFRESH-OPERATOR-RUNBOOK.md) and− `LAUNCH.md` with their target-specific authorization and prerequisites. Use+ # MCP Trust Registry+ ## Purpose+ MCP Trust Registry is a neutral public trust registry for MCP servers. Its+ product loop is "check before you connect": register public MCP servers, scan+ them with a pluggable engine, normalize results into an A-F danger grade plus a+ transparency signal, persist the record, and serve it through a public API, web+ catalog, and README badge endpoint.+ The scanner is a replaceable backend. The durable product is the public catalog,+ stable lookup API, trust-grade normalization, and author badge distribution+ loop. The real engine adapter wraps `mcp-audits`; `StubEngine` keeps the system+ testable without launching untrusted code.+ ## Layout+ - `src/mcp_trust/api/`: FastAPI service and public API projection.+ - `src/mcp_trust/core/`: domain models, grading, governance, and provenance.+ - `src/mcp_trust/engine/`: scan engine contract, stub, and optional real adapter.+ - `src/mcp_trust/store/`: SQLite schema and repositories.+ - `src/mcp_trust/site/`: static site and badge generation.+ - `scripts/`, `deploy/`, `docker/`, `docs/`: operator tooling, deployment+   assets, scan environments, and product/runbook documentation.+ - `contracts/web-release-readback-v1/`: additive readback schemas and policy.+ `SPEC.md` is the product and module-boundary contract. `LAUNCH.md` and the+ operator runbook describe separately authorized operator workflows.+ ## Setup+ Use Python 3.12 or newer. `.python-version` pins Python 3.15.0, and `uv.lock`+ locks the project and development dependencies. Install the pinned uv version+ (`0.13.0`) and run:+ ```bash+ make setup+ ```+ This installs the core and development dependencies. It does not install the+ optional `mcp-audits` engine extra or enable real-server/Docker scans.+ ## Checks+ Run the aggregate local gate with:+ ```bash+ make check+ ```+ It checks the lockfile, Ruff lint and formatting, Pyright, deterministic pytest+ coverage, and package builds. Opt-in integration and Docker tests remain off.+ See the README Quickstart and local development instructions for focused test+ commands and a stub-only preview.

    Showing the first 40 of each.

  • AGENTS.md +10 −23

    https://raw.githubusercontent.com/saagpatel/mcp-trust/HEAD/AGENTS.md 

    − Install and run the deterministic local path. `uv venv` reads `.python-version`,− so the virtualenv is built on 3.11 rather than whatever interpreter happens to be− first on `PATH`; do not remove that file. Activate before running anything, or use− `uv run --frozen --extra dev <command>` instead.− ```bash− uv venv .venv− . .venv/bin/activate− uv pip install -e ".[dev]"− python -m pytest -q− ruff check src tests− mcp-trust seed− mcp-trust scan mcp-reference-time− mcp-trust check mcp-reference-time− mcp-trust serve− ```− Run the real engine only when the target server is trusted or sandboxed:− ```bash− uv pip install -e ".[dev,engine]"− MCP_TRUST_ENGINE=mcpaudit mcp-trust scan mcp-reference-time− MCP_TRUST_ENGINE=mcpaudit MCP_TRUST_SANDBOX=docker mcp-trust scan mcp-reference-time− ```− Use `LAUNCH.md` as the public-launch runbook. Use `SPEC.md` as the product and− module-boundary contract.+ Use the README's [Quickstart](README.md#quickstart) for an isolated stub demo and+ [local development and verification](README.md#local-development-and-verification)+ for frozen core/dev setup, focused and broader pytest checks, Ruff, packaging,+ and conditional browser preview. `.python-version` pins the CI interpreter;+ keep it and `uv.lock`. The routine verification path does not install the engine+ extra or opt into real-server/Docker tests.+ Real scans, qualification, refresh, and launch are separate operator workflows:+ follow the [operator runbook](docs/GRADE-REFRESH-OPERATOR-RUNBOOK.md) and+ `LAUNCH.md` with their target-specific authorization and prerequisites. Use+ `SPEC.md` as the product and module-boundary contract.
mcp-trust MCP server