Power your agent
पब्लिशर की अपनी कमांड। PlugMCP एंडपॉइंट नहीं।
Host a copy with our keys and logs.
npx -y [email protected]Claude Code में लोकल कमांड के लिए इंस्टॉल लिंक नहीं है। नीचे दी गई कमांड कॉपी करें और टर्मिनल में चलाएँ।
claude mcp add ai-trust -- npx -y ai-trust@0.7.6टर्मिनल में चलाएँ।
{ "mcpServers": { "ai-trust": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
रिमोट URL या आपकी मशीन पर कमांड? दोनों इंस्टॉल में क्या अंतर है
PlugMCP पर चलाएँ
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
लॉन्चपब्लिशर से
Trust verification CLI for AI packages: MCP servers, A2A agents, skills, AI tools and LLMs. It prints the OpenA2A Registry's scans and known advisories for a package, or downloads and scans it locally with HackMyAgent. For general-purpose libraries such as , use instead.
Trust verification CLI for AI packages — check MCP servers, A2A agents, AI tools, and LLMs before you install
expressnpx ai-trust check @modelcontextprotocol/server-filesystem --no-scan
What it prints (full output):
@modelcontextprotocol/server-filesystem MCP server · scanned 233 days ago (stale)
Passed, but the registry recorded 1 high finding
Trust ━━━━━━━━━━━━━━━━━━━━ 79/100
Level Scanned Blocked > Warning > Listed > Scanned > Verified
Scans 3 community scans
Last scan 233 days ago (stale)
Findings 0 critical · 1 high (details not returned) · scan status warnings
CVEs none recorded
── Next Steps ──────────────────────────────────────────────
→ Fresh scan ai-trust check @modelcontextprotocol/server-filesystem
It needs Node.js ^20.19 or 22.12+ and no account.
npx ai-trust check @modelcontextprotocol/server-filesystem
Without --no-scan, check downloads the package to a temporary directory and scans it with the bundled HackMyAgent. A general-purpose library gets an out-of-scope notice instead. Deep scans download their model from huggingface.co to ~/.nanomind/models once; --no-deep does not.
check exits 0 for a safe or out-of-scope package, 1 on an operational error, and 2 for a warning or blocked verdict or a package not found.
npx ai-trust audit package.json --min-trust 3
audit reads package.json or requirements.txt, looks up each dependency and lists libraries as out of scope. It exits 2, failing the job, when a package has a warning or blocked verdict, falls below --min-trust, or is not in the registry and was not scanned. Exit 1 is an operational error.
--min-trust defaults to 2 (Listed), so a listed but unscanned package passes; 3 requires a HackMyAgent scan. On a terminal audit offers to scan unknown packages; in CI, pass --scan-missing. ai-trust batch <names...> checks named packages. Sample output.
npm install -g ai-trust
brew install opena2a-org/tap/ai-trust
On Linux x64, npm also runs the install script of onnxruntime-node, a scanner dependency, which downloads CUDA provider binaries from NuGet unless ONNXRUNTIME_NODE_INSTALL=skip is set. Build from source or check a release's provenance: docs/install.md.
opena2a-cli is the unified CLI for the OpenA2A security toolchain. ai-trust powers opena2a registry.
npm install -g opena2a-cli
opena2a registry @modelcontextprotocol/server-filesystem
opena2a review
Usage telemetry is on by default. After each command, ai-trust sends the tool name and version, the command name, success, duration, platform and Node.js major version to the OpenA2A Registry (api.oa2a.org), and no package name, argument, file path or content.
Each event carries an install ID, a persistent hash derived from this machine's ID and kept in ~/.config/opena2a/telemetry.json, so the data is personal data. Policy: opena2a.org/telemetry.
ai-trust telemetry off # or set OPENA2A_TELEMETRY=off for one run
ai-trust telemetry status # the current state and install ID
Sharing scan results is opt-in: ai-trust config contribute on, or --contribute for one scan; audit on a terminal asks. A shared scan sends the registry the package name, version and ecosystem, score, verdict and per-check results, not file paths or source code; a pseudonymous contributor token goes with saved consent or summaries queued earlier.
The bundled scanner sends no telemetry or scan results, and no file to any LLM provider: ai-trust runs it without your saved choices, its telemetry or ANTHROPIC_API_KEY. The choice, in ~/.opena2a/config.json, is shared by OpenA2A tools; ai-trust config contribute off turns it off.
Recorded with ai-trust 0.7.6 on 2026-10-22
Apache-2.0.
Trust verification CLI for AI packages — check MCP servers, A2A agents, AI tools, and LLMs before you install
{ "mcpServers": { "ai-trust": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}टूल
अभी टूल सूची नहीं है। रिमोट सर्वर को पहले हेल्थ चेक के बाद सूची मिलती है।
FAQ
इस पेज पर Cursor, Claude Desktop, Claude Code या VS Code के लिए stdio कॉन्फ़िग कॉपी करें। यह पब्लिशर का इंस्टॉल इस्तेमाल करता है, PlugMCP प्रॉक्सी नहीं।
इस रिकॉर्ड में कोई ज़रूरी एनवायरनमेंट वेरिएबल दर्ज नहीं है।
Ai Trust stdio पर लोकल चलता है।
पिछली जाँच 2026-11-15 को हुई। Trust verification CLI for AI packages — check MCP servers, A2A agents, AI tools, and LLMs before you install