Potencia tu agente
Instalación del publicador. No es un endpoint de PlugMCP.
Host a copy with our keys and logs.
Aún no hay una versión empaquetada en el registro. Sigue el README del repositorio.
¿URL remota o un comando en tu máquina? En qué se diferencian las dos instalaciones
Ejecutar en PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
AbrirDel publicador
OpenTrustBench is a trust and security verification platform for autonomous AI agents and MCP (Model Context Protocol) servers. It scans your codebase for vulnerabilities, maps findings to OWASP Agentic AI Top 10 and OWASP LLM Top 10 2025, generates a verifiable with a letter grade, and provides a for your README.
Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero telemetry.
Local analysis, no OpenTrustBench telemetry. Dependency auditing uses the npm registry. No account required.
# Scan a local folder, MCP server, or Agent Skill
npx @opentrustbench/cli scan ./my-mcp-server
# Scan a GitHub repository
npx @opentrustbench/cli scan https://github.com/owner/repo
# Scan an npm package
npx @opentrustbench/cli scan some-npm-package --npm
# Fail CI when findings meet a severity threshold
npx @opentrustbench/cli scan ./my-mcp-server --fail-on high
# Run the OWASP Agentic Top 10 Adversarial Attack Suite
npx @opentrustbench/cli attack ./my-mcp-server
# Evaluate workflow reliability
npx @opentrustbench/cli eval ./tests/workflow.yaml
Embed your trust score in your README:
[](https://www.opentrustbench.com/r/self-packages-cli.html)
This tells buyers, auditors, and AI hosts that your agent has been verified.
opentrustbench at a local directory, GitHub repo, or npm packagenpm audit integration for lockfile-based vulnerability detection--fail-on severity gate for pipeline enforcementattack is static-heuristic: it re-analyzes scan findings + permissions. No payloads execute.eval is simulation mode: suites are parsed and validated; nothing runs, costs/durations stay 0.Need a human pass over your results? Request a review — manual result triage plus a remediation plan, scoped per target. The CLI stays the product and is free forever.
packages/
core/ — Detection engines, OWASP rules, trust scoring, attack analysis
cli/ — Terminal CLI with SARIF export and badge generation
action/ — GitHub Action for CI/CD pipelines
web/ — Landing page and interactive demo
badges/ — Shareable grade badge SVGs
examples/ — Vulnerable and secure test fixtures
scripts/ — Verification and demo scripts
docs/ — Research, registry report, and versioned roadmap (ROADMAP.md)
npm install # installs + builds via prepare
npm test # build + 28 unit tests
node scripts/verify-demos.mjs # end-to-end smoke checks
Apache 2.0 © 2026 Eulogik
Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero telemetry.
Herramientas
Aún no hay lista de herramientas. Los servidores remotos la reciben tras la primera comprobación de estado.
Preguntas frecuentes
Copia en esta página la configuración stdio para Cursor, Claude Desktop, Claude Code o VS Code. Usa la instalación del publicador, no un proxy de PlugMCP.
Este registro no indica ninguna variable de entorno obligatoria.
OpenTrustBench se ejecuta localmente por stdio.
Última comprobación: 2026-11-10. Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero telemetry.