Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/saagpatel/mcp-trust/agents-mdgit clone --depth 1 https://github.com/saagpatel/mcp-trustWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01505 | $0.01505 |
| Opus 5 | $0.00753 | $0.00753 |
| Sonnet 5 | $0.00301 | $0.00301 |
| Haiku 4.5 | $0.00151 | $0.00151 |
Grade A, and why
mcp-trust AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — MCP Trust Registry
Project Summary
MCP Trust Registry is a neutral public trust registry for MCP servers. Its product loop is "check before you connect": register public MCP servers, scan them with a pluggable engine, normalize the results into an A-F danger grade plus transparency signal, persist the record, and serve it through a public API, web catalog, and README badge endpoint.
This repo is not trying to win by being another scanner. The scanner is a
replaceable backend; the durable layer is the public catalog, stable lookup API,
trust-grade normalization, and author badge distribution loop. The current real
engine adapter wraps mcp-audits, while the default StubEngine keeps the full
system testable without launching untrusted code.
Current State
The MVP is built and tested end to end: seed catalog, scan, grade, persist, serve JSON and web views, and emit shields.io-compatible badge JSON. The repository is public. Treat anything committed here, and anything written in an issue or pull request, as published the moment it lands. The product itself is pre-launch. The seed catalog now contains official reference MCP servers for launch calibration. Product launch is gated by validating sandboxed real-engine scans, inspecting the grade distribution, deciding whether to broaden beyond reference servers, deploying the FastAPI app with persistent SQLite storage, and smoke-testing the badge loop against the public base URL.
Stack
- Python 3.11, pinned by
.python-versionsouv venvanduv runmatch CI - FastAPI and Uvicorn for the API/web surface
- Typer for the CLI
- Pydantic domain models
- SQLite persistence
- Pytest and Ruff for local verification
- Optional
mcp-auditsengine extra for real MCP-server scanning
How To Run
Install and run the deterministic local path. uv venv reads .python-version,
so the virtualenv is built on 3.11 rather than whatever interpreter happens to be
first on PATH; do not remove that file. Activate before running anything, or use
uv run --frozen --extra dev <command> instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 135 lines · 1,505 tokens per session scan A 23d4f2cd6bec
mcp-trust AGENTS.md is an instructions file published in the GitHub repository saagpatel/mcp-trust (0 stars, last pushed 9d ago), licensed MIT. It adds 1,505 tokens to every session, about $0.0075 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
lesswrong-mcp CLAUDE.md
Instructions for seankessinger/lesswrong-mcp, covering claude.md — lesswrong-mcp, what this is, layout, the two backends and shared internals.
qwed-mcp copilot-instructions.md
Copilot instructions for QWED-AI/qwed-mcp: Read and follow QWEDRULES.md for every suggestion.
agentcloud AGENTS.md
AGENTS.md instructions for premhiru/agentcloud, covering agentcloud engineering rules and this is not the next.js you know.
agentgate-governed-writefile-demo AGENTS.md
Instructions for selfradiance/agentgate-governed-writefile-demo, a project described as: Smallest outsider-readable proof path through AgentGate + MCP Firewall: governed writefile, independent on-disk verification, and inspectable audit artifacts.
mcp-server-stage0-authorization AGENTS.md
AGENTS.md instructions for Starlight143/mcp-server-stage0-authorization, covering agents.md, project overview, repository structure, key concepts and authorization context fields.
llm-context.py CLAUDE.md
Instructions for cyberchitta/llm-context.py, covering claude.md, working notes (gitignored) and draining the field notes.