TrustedMCP API and MCP Server: MCP Grades for Your Agent

Add the MCP server

The trustedmcp package runs on your machine over stdio. It needs Node.js 18 or later.

Claude Code

claude mcp add trustedmcp -- npx -y trustedmcp mcp

Claude Desktop, Cursor and Windsurf

Add this to claude_desktop_config.json, ~/.cursor/mcp.json or ~/.codeium/windsurf/mcp_config.json:

{
    "mcpServers": {
        "trustedmcp": {
            "command": "npx",
            "args": [
                "-y",
                "trustedmcp",
                "mcp"
            ]
        }
    }
}

VS Code

Add this to .vscode/mcp.json:

{
    "servers": {
        "trustedmcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "trustedmcp",
                "mcp"
            ]
        }
    }
}

Tools

Tool	What it does
`lookup_server`	One server by name, npm or PyPI package, Docker image, URL or repo: its grade, the four checks, what to fix first and its TrustedMCP page.
`check_config`	A whole MCP config (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf): a grade for every server in it, and which ones we have no grade for.
`find_alternatives`	Graded servers by category or minimum grade, for example "a database server graded B or better".
`registry_lookup`	An official MCP Registry entry: publisher, versions, how it runs, and any reported security issues.

What leaves your machine

check_config reads your config file locally. It sends us only package names, image names and server URLs, without query strings. Environment variables, headers, tokens and file paths stay on your machine. We don't store what you send.

The source is on GitHub under the MIT license.

Use the JSON API

Base URL: https://trustedmcp.io/api/v1. Every endpoint is read-only and returns JSON. Browsers can call it too, because CORS is open.

Endpoint	What you get
`GET /servers`	Graded servers. Filters: q, category, min_grade (A-D), limit (up to 50), offset.
`GET /servers/{slug}`	One graded server, with login detail, transport, A/B alternatives for a C or D server, and linked registry entries.
`GET /lookup?q=`	Anything you have: a name, package, image, URL, repo, registry name or launch command.
`POST /check`	Up to 50 config entries at once. Returns a status per entry: graded, registry_only or unknown.
`GET /registry/{name}`	One official MCP Registry entry and its reported issues.
`GET /categories`	Categories with at least one graded server.

Examples

curl "https://trustedmcp.io/api/v1/lookup?q=@playwright/mcp"

curl -X POST "https://trustedmcp.io/api/v1/check" \
  -H "Content-Type: application/json" \
  -d '{"servers":[{"name":"notion","url":"https://mcp.notion.com/mcp"},
       {"name":"fs","command":"npx","args":["-y","@modelcontextprotocol/server-filesystem"]}]}'

A server in the response has its grade (A to D), the four checks with a state (full, part or empty) and a short note, fix_first, and the url of its page here.

Limits

Without a key: 30 requests a minute per IP address.
With a free key: 300 requests a minute. Send it as Authorization: Bearer tmcp_... or X-API-Key.
Past the limit you get HTTP 429 with a Retry-After header. Responses are cached for 5 minutes.

Terms

The API is free. Where you show a grade, credit "Grades by TrustedMCP" and link to the server's page (the url field).
Show a grade for what it is: an assessment from public signals, not an audit of the code.
In v1 we may add fields, but we won't rename or remove any. Breaking changes get a new version.

TrustedMCP API and MCP Server