co.launchtrust/launchtrust

Official9 tools

by mustafasalimerek-bit · TypeScript

LaunchTrust

Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.

Scan applications for secrets, exposed files, headers, privacy issues, and AI disclosure.

Captured live from the server via tools/list.

scan_url

Run a FREE LaunchTrust compliance + security quick-scan on a public web URL. Returns a focused SUBSET of checks — leaked frontend secrets/API keys, exposed .env//.git, security headers, HTTPS/HSTS, missing privacy/terms pages, trackers/cookie banner, and AI-interaction disclosure. The result is unsigned and not stored. The full 27-detector signed, dated, continuously-monitored scan requires a LaunchTrust account. Compliance aid, not legal advice.

Parameters (1)

urlstringrequired
Public http(s) URL to scan, e.g. https://example.com

list_jurisdictions

List the jurisdictions and categories LaunchTrust tracks (e.g. EU AI Act, GDPR, US state privacy laws, app-store policies). Public coverage registry. Compliance aid, not legal advice.

No parameters.

get_compliance_rules

Fetch LaunchTrust's sourced, founder-reviewed compliance rule snapshots, optionally filtered to one jurisdiction code (e.g. eu-ai-act-50, gdpr, ca-sb243). Compliance aid, not legal advice.

Parameters (1)

jurisdictionstring
Optional jurisdiction code to filter by, e.g. gdpr or eu-ai-act-50.

verify_record

Independently verify the ECDSA (ES256) signature on a LaunchTrust signed scan/disclosure record against the published public key. Pass the record JSON (the downloaded record, or an object containing `canonical` and `signature`).

Parameters (1)

recordobjectrequired
The LaunchTrust signed record JSON (or an object with `canonical` + `signature`).

list_my_apps

List the apps registered in your LaunchTrust account, with each one's latest scan status. Requires a LaunchTrust token.

No parameters.

register_app

Register a web URL in your LaunchTrust account so it can be fully scanned and monitored. Idempotent — if the URL is already registered, returns the existing app. Requires a LaunchTrust token and an active subscription.

Parameters (2)

urlstringrequired
Public https URL of the app to register.
namestring
Optional label (defaults to the hostname).

scan_app

Run the full LaunchTrust scan on one of your registered apps and store a signed, dated evidence record. Requires a LaunchTrust token and an active subscription. Limited to 5 scans per app per day.

Parameters (1)

app_idstringrequired
The id of a registered app (see list_my_apps or register_app).

get_scan_history

List recent scans (summary + findings) for one of your registered apps. Requires a LaunchTrust token.

Parameters (1)

app_idstringrequired
The id of a registered app.

get_market_report

Get the latest scan for one of your registered apps, with each finding annotated by the jurisdictions and rules applicable to that app's target markets. Requires a LaunchTrust token.

Parameters (1)

app_idstringrequired
The id of a registered app.

README.md4 KBView on GitHub

LaunchTrust MCP

Run a compliance + security scan on your app — without leaving Claude Code.

LaunchTrust scans a public URL for the compliance and security gaps that get indie apps rejected or fined — leaked frontend API keys, exposed .env/.git, missing privacy/terms pages, absent security headers, undisclosed AI interactions, tracker/cookie issues — mapped to 39 jurisdictions (EU AI Act, GDPR, US state privacy laws, app-store policies).

It's a remote, hosted MCP server — nothing to install, build, or run. Add the URL and go.

⚖️ Compliance aid, not legal advice. Not a certification of compliance.

Install (Claude Code)

claude mcp add --transport http launchtrust https://mcp.launchtrust.co/mcp

Then ask Claude:

"Scan https://my-app.com for compliance and security issues."

Works in any MCP client that supports remote Streamable HTTP servers (Claude Code, Claude Desktop, …).

What the free scan checks

scan_url runs a focused, high-signal subset of detectors against any public URL — no account needed:

🔑 Leaked frontend API keys / secrets
📂 Exposed .env / .git / config files
🛡️ Security headers (CSP, HSTS, X-Frame-Options, …) + HTTPS/HSTS
📄 Missing privacy / terms pages
🤖 Undisclosed AI interactions
🍪 Trackers / cookie-consent

The result is plain text, unsigned and not stored.

Tools

Free — no account

Tool	Description
`scan_url`	Quick compliance + security scan of any public URL.
`list_jurisdictions`	Jurisdictions & categories covered (EU AI Act, GDPR, US states, app stores).
`get_compliance_rules`	Sourced compliance rule snapshots, filterable by jurisdiction.
`verify_record`	Independently verify the ES256 signature on a LaunchTrust signed record.

Account — needs a token

The full version runs all 27 detectors across 39 jurisdictions, stores a signed, dated evidence record, and monitors continuously. Connect with your LaunchTrust token:

claude mcp add --transport http launchtrust https://mcp.launchtrust.co/mcp \
  --header "Authorization: Bearer lt_pat_..."

Tool	Description
`register_app`	Register a web app to scan & monitor (idempotent).
`scan_app`	Full 27-detector signed scan of a registered app.
`get_scan_history`	Recent scans for an app.
`get_market_report`	Findings annotated by your target-market jurisdictions.
`list_my_apps`	Your registered apps + latest status.

Get a token at launchtrust.co.

Use in other MCP clients

LaunchTrust is a standard remote (Streamable HTTP) MCP server — it works in any MCP-compatible client, not just Claude Code.

Codex CLI — add to ~/.codex/config.toml:

toml

[mcp_servers.launchtrust]
url = "https://mcp.launchtrust.co/mcp"

Gemini CLI — add to ~/.gemini/settings.json:

json

{
  "mcpServers": {
    "launchtrust": { "httpUrl": "https://mcp.launchtrust.co/mcp" }
  }
}

Cursor, Windsurf, and others — point them at the remote URL https://mcp.launchtrust.co/mcp (Streamable HTTP).

For the account-gated tools, pass your token as an Authorization: Bearer lt_pat_... header (Claude Code: --header; Codex: http_headers = { Authorization = "Bearer lt_pat_..." }; Gemini: "headers": { "Authorization": "Bearer lt_pat_..." }).

How it works

Transport: stateless Streamable HTTP (MCP spec 2025-11-25) at POST /mcp.
Privacy: the free scan stores nothing — it fetches your URL, runs detectors, returns findings. Premium scans store a signed record under your account only.
Honesty: it never invents findings. Every result traces to what was actually on the page, and it reports mechanical signals (detected / not_detected) — never a verdict of "compliant".

Development

Zero-dependency Cloudflare Worker; a thin client over the LaunchTrust API.

npm install
npm run typecheck
npm run dev        # wrangler dev — POST http://localhost:8787/mcp
npm run deploy     # wrangler deploy (custom domain in wrangler.toml)

LaunchTrust is a compliance aid, not legal advice, and is not a certification of compliance with any law.

Install

claude_desktop_config.json

{
  "mcpServers": {
    "launchtrust": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.launchtrust.co/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

scan_url

list_jurisdictions

get_compliance_rules

verify_record

list_my_apps

register_app

scan_app

get_scan_history

get_market_report

LaunchTrust MCP

Install (Claude Code)

What the free scan checks

Tools

Free — no account

Account — needs a token

Use in other MCP clients

How it works

Links

Development

Install