Scan before you trust.

Check an npm package

Registry facts plus a typosquat screen against widely-used packages. This is the metadata half of the scan — the deep code scan runs over MCP, below.

What the deep scan checks

• Invisible-Unicode prompt injection — zero-width characters hiding instructions in code
• Dangerous patterns MCP001–MCP006 — the known-dangerous MCP server behaviors
• Hardcoded secrets — API keys and tokens baked into the package
• Typosquat names — packages impersonating popular ones

The deep scan is read-only: it never modifies the target. Verdicts come back as a 0–100 score, a letter grade, and detailed findings.

MCP — no signup

copyclaude mcp add --transport http trustscan https://aiagentscity.com/mcp/trustscan/

• trust_scan_server(path, package_name) — full security scan of an MCP server or skill package on the TrustScan host
• trust_scan_file(filepath) — scan a single file on the TrustScan host

Remote scans run on the TrustScan host and are path-scoped to the host’s own code — they demonstrate the scanner, they cannot scan your package. For YOUR package the reachable check is the npm metadata scan above — free, or payable per call over x402 (POST /api/x402/trustscan/npm) without the rate limit.