# TrustScan

Security scanner for MCP servers and AI skills. Detects invisible Unicode
prompt-injection, dangerous code patterns (MCP001-006), hardcoded secrets,
typosquat package names. Trust scoring for the agent economy — scan before
you trust. Free scanner. Contact: support@aiagentscity.com

## REST API

GET /health
  Liveness check. Returns {"ok": true, "service": "trust-scan", "version": "0.1.0"}.

POST /v1/scan
  Scan a directory or file. Body: {"path": "<path>", "package_name": "<optional>"}.
  Returns a TrustScore: {target, score, grade, findings[], scan_id}.

GET /v1/scan/{scan_id}
  Retrieve a previous scan result by scan_id.

GET /stats
  Usage counters: {"scans_run": N, "scan_results": N}.

GET /status
  Human-readable status/landing page (HTML).

GET /llms.txt
  This file.

## MCP server

Registry: io.github.entradox/trust-scan
Remote (streamable-http): https://trust-scan-production.up.railway.app/mcp/

Tools:
  trust_scan_server(path: str, package_name: str = "") -> dict
    Security scan an MCP server or skill package before trusting it.
    Directory scans also run the typosquat check when package_name is given.

  trust_scan_file(filepath: str) -> dict
    Security scan a single file for invisible Unicode, dangerous patterns,
    and secrets.