About trustlists
trustlists is an MCP server for searching public vendor trust centers and handling related security workflows. It also supports signed-in SOC 2 report analysis and requests for access to vendor trust centers.
Key features
- 01Search, look up, and filter trust centers
- 02Map project manifests to vendor records
- 03Analyze local SOC 2 PDFs
- 04Request vendor trust-center access
Use cases
- 01Find a vendor’s public security documentation
- 02Check vendors referenced by project dependencies
- 03Review a SOC 2 report
- 04Request access to a private trust center
MCP support
Exposes directory search, lookup, browsing, and dependency-audit tools to MCP clients, plus account-based SOC 2 analysis and vendor access requests. Clients can run the package locally or use the hosted endpoint after OAuth sign-in.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
Tools
15Saved tool list · updated 2w ago
| Parameter | Type | Required | Description |
|---|---|---|---|
| limit | integer | No | Max results to return (1-20, default 8). |
| query | string | Yes | Company name or domain to search for (min 2 characters). |
Details
From the project README@trustlists/mcp
MCP server that gives AI assistants access to the public trustlists directory, plus signed-in SOC 2 analysis and trust-center access requests.
This npm package powers the trustlists_ plugin for Cursor, Claude Code, and other Model Context Protocol clients.
Installation
You don't install this package directly. It is spawned by your MCP-aware AI client.
Cursor
The trustlists_ plugin handles installation. Or add it manually to
~/.cursor/mcp.json:
{
"mcpServers": {
"trustlists": {
"command": "npx",
"args": ["-y", "@trustlists/mcp"]
}
}
}
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"trustlists": {
"command": "npx",
"args": ["-y", "@trustlists/mcp"]
}
}
}
Tools
Free (no account)
| Tool | Description |
|---|---|
trustlists_search | Search thousands of trust centers by name or domain |
trustlists_lookup | Look up a single vendor by exact domain |
trustlists_browse | Filter by platform, listed framework, or CSA STAR level |
trustlists_audit_dependencies | Map project manifests to public vendor trust centers |
Account
Sign in with trustlists_login (device code). Credentials are stored in
~/.trustlists/auth.json on this machine. The hosted endpoint at
mcp.trustlists.org/mcp serves these tools after an OAuth sign-in instead, with
SOC 2 uploads in the trustlists app (trustlists_soc2_upload) in place of local
PDF paths.
| Tool | Description |
|---|---|
trustlists_login / logout / whoami | Device-code sign-in and session |
trustlists_soc2_analyze / status / report | Analyze local SOC 2 PDFs (preview, then confirmCredits) |
trustlists_requester_profile | Identity used on vendor access forms |
trustlists_access_request / status / continue | Request SafeBase/Vanta access (preview, then confirm) |
trustlists_access_request_batch | Same, up to 5 vendors, one confirm |
Directory labels show what a public record lists. They do not independently prove certification scope, validity, legal compliance, or security quality.
Supported manifest formats (audit tool)
package.json(npm/yarn/pnpm)requirements.txt,pyproject.toml,Pipfile(Python)go.mod(Go)Cargo.toml(Rust)Gemfile(Ruby)composer.json(PHP)
License
Apache 2.0. See LICENSE and NOTICE.
Links
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.