Look up independent trust ratings and security, maintenance, and adoption evidence for MCP servers.
com.mcplookup/mcp MCP Server
The com.mcplookup/mcp server (slug: com-mcplookup-mcp) looks up independent trust ratings and provides evidence related to security, maintenance, and adoption for MCP servers. It is distributed as an npm package (@mcplookup/mcp) and is identified as a model-context-protocol-related tool. It has 3 tools.
Resolve a named MCP server, vendor, product, package, repository, Registry identifier, or endpoint to a canonical MCPLookup identity. Returns at most five reviewed candidates with query-relative identity and publisher explanations, a compact trust assessment, and current connection options. This is the best fit when a particular artifact or product is known; find_servers covers open-ended capability discovery, while trust_lookup returns the full current evidence record for an exact canonical name.
Parameters1
identifier
string
required
Exact package identifier, endpoint URL, canonical name, or complete organization, product, or service name.
Find a compact, trust-aware shortlist for a task or capability when no particular MCP server or product is known. Search by free text or MCPLookup's normalized capability taxonomy, with optional filters. Free text returns a reviewed identity-only slate when available; otherwise results are explicitly labelled catalog matches, and the two evidence lanes are never mixed. Returns at most five results with no pagination. A selected exact server name can be passed to resolve_server for reviewed identity context and connection options; named artifacts fit resolve_server directly.
Parameters6
query
string
optional
Free-text discovery query when no exact server is known, such as 'postgres database'.
capability
string
optional
Normalized capability category; required when query is omitted.
Return MCPLookup's complete current trust record for one exact canonical MCP server name. Includes the verdict, Trust Index band and 0–100 score with confidence, coarse safety, maintenance, adoption, and provenance bands, coverage, freshness, public evidence, and citation. This fits trust questions and evidence review after identity is known; resolve_server handles ambiguous names or coordinates. Current state only—no history or safety certification.
Parameters1
server_name
string
required
Exact MCPLookup server name, e.g. 'io.github.owner/name'.
The official stdio compatibility wrapper for the MCPLookup remote MCP server—the
independent trust layer for MCP.
The canonical server is https://mcplookup.com/mcp. It provides three anonymous,
read-only tools:
resolve_server resolves a title, package, endpoint, or name to a canonical server.
find_servers finds up to five servers using MCPLookup's normalized taxonomy.
trust_lookup returns the current Trust Index, verdict, evidence, and citation.
This package exists for MCP clients that require a local stdio command. It forwards MCP
messages to the canonical hosted server without implementing scoring, storing evidence,
adding authentication, or changing tool results.
Connect
Connect directly when your client supports remote Streamable HTTP:
text
https://mcplookup.com/mcp
Use this package when your client requires a local stdio command:
Node.js 20 or newer is required. No API key or environment variable is needed.
Prefer a direct Streamable HTTP connection to https://mcplookup.com/mcp when your client
supports remote MCP servers. The package is a transport adapter, not a separate service.
MCP Registry
MCPLookup is listed in the official MCP Registry as
com.mcplookup/mcp.
The name is verified through DNS control of mcplookup.com.
One entry covers both connection paths, so a client installing from the Registry can use
whichever it supports:
Path
Declaration
Canonical remote
streamable-http → https://mcplookup.com/mcp
Compatibility package
npm @mcplookup/mcp, stdio transport
The entry declares no environment variables, headers, or credentials, matching the
anonymous public interface. server.json in this repository is the source
of that metadata.
What stays remote
The wrapper contains no trust scores, evidence database, taxonomy, authentication system,
or scoring logic. MCPLookup evaluates public evidence at the canonical service and returns
the same bounded, current-state response whether a client connects directly or through this
stdio adapter.
The MIT license covers the plugin and wrapper software in this repository only. It does not
license MCPLookup's hosted evidence database, assessments, verdicts, scores, classifications,
taxonomy, historical record, or scoring framework. Use of service data remains governed by
the MCPLookup terms.
Data and security
The wrapper has no credentials and writes no local data. Requests are sent to MCPLookup's
hosted endpoint, where bounded security and product telemetry are processed under the
MCPLookup privacy policy. See the
MCP documentation for the public interface contract.
Bug reports and narrowly scoped compatibility improvements are welcome. See
CONTRIBUTING.md before opening a pull request.
Development
bash
npm test
npm pack --dry-run
The package intentionally has zero runtime dependencies.
Marketplace package
This repository also contains the shared MCPLookup marketplace package:
.claude-plugin/plugin.json and .mcp.json package the remote server for Claude.
.codex-plugin/plugin.json packages the same remote server for ChatGPT and Codex.
skills/verify-mcp-server/SKILL.md adds the proactive pre-connect verification workflow.
review/marketplace-cases.md defines the positive, negative, and direct-connect release cases.
The skill improves orchestration but is not required for correct tool selection. Direct MCP,
Registry, npm-wrapper, and VS Code clients receive independently useful tool descriptions and
server instructions from the canonical hosted service.
