AI Trust — Security skill for Claude Code
VirusTotal for AI packages.
How to install AI Trust
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open opena2a-org/ai-trust and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What AI Trust does
VirusTotal for AI packages. ai-trust check returns a 0-100 trust score from the OpenA2A Registry trust graph, covering security scans, advisories, and dependency risk. For MCP servers, A2A agents, skills, and LLM packages.
Alternatives in Security
- Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
- Cross-Pollinate Hex MCP Servers — Diff-driven audit: find real transferable changes across hex-line-mcp, hex-ssh-mcp, hex-graph-mcp 238 ★
- Openclaw Ops — OpenClaw operations skill with health checks, repair scripts, watchdogs, update triage, and security scans 225 ★
README
ai-trust
[](STATUS.md) [](https://github.com/opena2a-org/ai-trust/releases) [](https://opensource.org/licenses/Apache-2.0) [](https://github.com/opena2a-org/ai-trust/actions/workflows/ci.yml)
Trust verification CLI for AI packages: MCP servers, A2A agents, skills, AI tools and LLMs. It prints the OpenA2A Registry's scans and known advisories for a package, or downloads and scans it locally with HackMyAgent. For general-purpose libraries such as `express`, use [HackMyAgent](https://github.com/opena2a-org/hackmyagent) instead.
npx ai-trust check @modelcontextprotocol/server-filesystem --no-scanWhat it prints ([full output](docs/captures/quick-start.txt)):
@modelcontextprotocol/server-filesystem mcp server · scanned 228 days ago (stale)
Passed, but the registry recorded 1 high finding
Trust ━━━━━━━━━━━━━━━━━━━━ 79/100
Level Scanned Blocked > Warning > Listed > Scanned > Verified
Scans 3 community scans
Last scan 228 days ago (stale)
Findings 0 critical · 1 high (details not returned) · scan status warnings
CVEs none recorded
── Next Steps ──────────────────────────────────────────────
→ Fresh scan ai-trust check @modelcontextprotocol/server-filesystemIt needs Node.js 20.19+ or 22.12+ and no account.
- Check a package before you install it
- Gate a project's AI dependencies in CI
- Run it through opena2a-cli
- Share scan results with the registry
Check a package before you install it
npx ai-trust check @modelcontextprotocol/server-filesystemRelated Skills
Review Dependency Risk
Audit dependency manifests for supply-chain risk: unmaintained or typosquatted packages, license conflicts, un
Skill Auditor Desktop
Security audit skill for claude.ai / Claude Desktop — scans uploaded skills for prompt injection, data exfiltr
Security Sweep
Comprehensive security scanner covering OWASP Top 10 (2025), Mobile Top 10 (2024), and LLM Top 10 (2025). Scan
Massu Deps
Dependency audit covering security vulnerabilities, updates, and compatibility analysis
Zorille
Four Claude Code skills for codebase hygiene: codebase-audit (find issues) + plan-fixes (turn issues into PR-s
Heeler Security Review
Perform a repository security review for the current project directory, including secrets exposure risk, depen
Related Agents
Dependency Doctor
Dependency health management — outdated packages, vulnerabilities (CVE), breaking change risk for major bumps.
Sf Security Engineer
Security Engineer of the Software Factory cell. Use to run SAST/dependency/secret scans, verify zero-trust sec
Escalation Scout
Scans a whole support queue (Zendesk or Freshdesk export, or connector data) for churn, legal, security and VI
