Honest pros, cons, and verdict on this security tool
✅ Purpose-built for MCP-specific threats (tool poisoning, prompt injection) — not generic SCA
Starting Price
Free
Free Tier
Yes
Category
security
Skill Level
Low Code
A continuously scanned, security-scored registry of 16,000+ MCP servers, grading each version for tool poisoning, prompt injection, supply-chain, and credential risk.
The Canopii Trust Index is a public registry that puts a security score on the Model Context Protocol (MCP) ecosystem — the plugin layer that AI agents like Claude use to reach external tools. Before your agent connects to a third-party MCP server, the Trust Index tells you how risky that server actually is. Every server is independently and continuously scanned for the threats specific to agent tooling: tool poisoning, prompt injection, supply-chain risk, and credential exposure, with one score assigned per version so a rug-pull update can't hide behind an old grade. At profiling time the index covered around 16,300 servers, with 12,753 scored: 45% rated A (strong posture), 42% rated B, and 1,283 servers flagged high-risk (grade D or F); 4,248 endpoints were live-verified and roughly 3,500 remained unverifiable. The site lets anyone browse all servers, see top-scored and needs-review listings, and read the scoring methodology. For teams operating agents in production, Canopii also offers a key-authenticated, rate-limited API so you can check any MCP server's security score from your own tooling — CI gates that block low-grade servers, procurement reviews, or agent allow-lists — plus an enterprise track. Canopii is not itself an MCP server; it is trust infrastructure for choosing which MCP servers your agents should be allowed to talk to.
per month
Canopii MCP Trust Index delivers on its promises as a security tool. While it has some limitations, the benefits outweigh the drawbacks for most users in its target market.
A continuously scanned, security-scored registry of 16,000+ MCP servers, grading each version for tool poisoning, prompt injection, supply-chain, and credential risk.
Yes, Canopii MCP Trust Index is good for security work. Users particularly appreciate purpose-built for mcp-specific threats (tool poisoning, prompt injection) — not generic sca. However, keep in mind enterprise/api pricing is 'by request' — no self-serve tiers published.
Yes, Canopii MCP Trust Index offers a free tier. However, premium features unlock additional functionality for professional users.
Canopii MCP Trust Index is best for Vetting a third-party MCP server before adding it to Claude, Cursor, or another agent client and Building CI gates or allow-lists that block low-scored MCP servers. It's particularly useful for security professionals who need security grades (a-f) for 16,300+ mcp servers, one score per version.
There are several security tools available. Compare features, pricing, and user reviews to find the best option for your needs.
Last verified March 2026