Purpose
AgentForge Trust MCP is an MCP server that exposes AgentForge Trust Score auditing tools to AI agents. Its core purpose is to let agents perform a trust score audit on any MCP server before connecting to it, thereby reducing security risk. Through a single MCP connection, you can access a directory of more than 100 MCP servers, enabling trust auditing, discovery, and execution.
Main Capabilities
Trust Score: The Trust Score ranges from 0–100 and is calculated from five dimensions: code health, security scan, behavioral audit, community trust, and EU compliance. Audits rotate every 14 days; evaluate_policy reports partial: true when not all dimensions are up to date.
Trust tools (no authentication required):
- check_trust: Returns the AgentForge Trust Score of a specified server via server_id, slug, or github_url. This tool should always be called before connecting to a new server.
- evaluate_policy: Allow/deny gating. Pass in a policy such as {min_overall: 70, required_badges: ["actively_maintained"]}, and it returns allowed: true|false along with details for each check.
- list_trusted: Searches the AgentForge directory for servers matching a category and trust threshold, suitable for needs like "help me find a secure database MCP server with an overall score ≥ 80".
- recommend: Natural language search with trust filtering, for example "I need to validate Czech VAT IDs" returns ranked results filtered by a minimum trust level.
Execution tools (new in v0.2.0):
- broadcast_search: Browses the entire directory using full-text or semantic search, returning ranked results with trust scores, categories, and connection metadata. No API key required—read-only directory access.
- call_tool: Calls any tool on any server in the directory through the AgentForge proxy. A single connection provides access to hundreds of downstream servers, and the proxy handles authentication, quotas, and trust gating. Pay per call via wallet.
- broadcast_search can also run a single query against N servers; AgentForge fans out the search, aggregates the results, and returns a unified ranked list.
- register_agent: Self-service agent registration that returns an af_agent_* API key. No manual signup, no dashboard—the key is returned on the first tool call. You can pass in name, description, capabilities, and optional homepage_url and metadata.
Security layer: v0.3.0 includes a P0 RCE sanitization layer, including input validation, call guards, and anomaly detection, with 27/27 tests passing and zero external runtime dependencies.
How to Use
Configure the MCP connection in clients such as Claude Desktop, Cursor, and OpenClaw to use it. Trust tools (check_trust, evaluate_policy, list_trusted, recommend) do not require an API key; execution tools (broadcast_search, call_tool) require self-service registration via register_agent first (one tool call, no signup). The full integration guide for external multi-agent systems (such as OpenClaw, Claude Desktop, Cursor, LangGraph, AutoGen, CrewAI) is available at agentforge.community/trust, and onboarding takes about 3 minutes.
Use Cases
- Perform a trust audit before connecting to a new MCP server
- Discover trusted MCP servers by category and trust threshold
- Execute tools on multiple downstream MCP servers through a single connection proxy
- Get server recommendations with natural language plus trust filtering
Limitations
- check_trust, evaluate_policy, list_trusted, and recommend do not require an API key; execution tools such as broadcast_search and call_tool require self-service registration and may involve per-callPaid.
- Audits rotate every 14 days, so not all dimensions may be up to date (in this case evaluate_policy reports partial: true).
- Details such as specific pricing, quota limits, and supported platforms are not provided in the official materials.
