You approved that MCP server once.
It changed last night.
Static scanners check a server the day you install it. TrustGate is the gate that keeps watching: pin the version you approved, and every tool-description change comes back as a human-readable diff that sits in PENDING RE-APPROVAL until a human says yes.
In September 2025 the postmark-mcp server shipped a silent update that added one BCC line and copied every email it sent — 1,643 downloads before removal. A one-time scan would have passed it twice. A diff would have caught the one line.
Free scan — one MCP setup, end to end
Paste a client config (Claude / Cursor / VS Code mcpServers JSON) and/or give a reachable HTTP MCP server URL. We check command & permission risk, static keys in env (names only — values are never shown or stored), tool-description injection patterns with quoted evidence, and the toxic-flow graph across all servers. Configs are never executed.
🔍 Injection patterns, quoted
Tool descriptions are scanned for override phrasing, hidden-recipient tricks, secret harvesting, shell embeds and more — every finding quotes the matched text as evidence.
☣ Toxic-flow graph
When read-private, ingest-untrusted and send-outbound capabilities coexist across your servers, one poisoned input can walk private data out the door. We draw the chain.
📌 Pinned baselines (Pro)
Pin what you approved. Scheduled re-scans diff every description against the pin. Any change → PENDING RE-APPROVAL, per-agent least-privilege policy, full baseline history and incident replay.
Free vs Pro
| Free | Pro $25/mo | Team $75/mo | |
|---|---|---|---|
| Full scan of one setup + shareable report | ✓ | ✓ | ✓ |
| Pinned baselines under continuous re-scan | — | ✓ | ✓ |
| Human-readable diffs + re-approval workflow | — | ✓ | ✓ |
| Baseline history / incident replay | — | ✓ | ✓ |
| Per-agent least-privilege policy & seats | — | 1 agent policy | Team policies, 5 seats |