Honest pros, cons, and verdict on this security tool
✅ Purpose-built for MCP-specific threats (tool poisoning, prompt injection) — not generic SCA
Starting Price
Free
Free Tier
Yes
Category
security
Skill Level
Low Code
A continuously scanned, security-scored registry of 16,000+ MCP servers, grading each version for tool poisoning, prompt injection, supply-chain, and credential risk.
The Canopii Trust Index is a public registry that puts a security score on the Model Context Protocol (MCP) ecosystem — the plugin layer that AI agents like Claude use to reach external tools. Before your agent connects to a third-party MCP server, the Trust Index tells you how risky that server actually is. Every server is independently and continuously scanned for the threats specific to agent tooling: tool poisoning, prompt injection, supply-chain risk, and credential exposure, with one score assigned per version so a rug-pull update can't hide behind an old grade. At profiling time the index covered around 16,300 servers, with 12,753 scored: 45% rated A (strong posture), 42% rated B, and 1,283 servers flagged high-risk (grade D or F); 4,248 endpoints were live-verified and roughly 3,500 remained unverifiable. The site lets anyone browse all servers, see top-scored and needs-review listings, and read the scoring methodology. For teams operating agents in production, Canopii also offers a key-authenticated, rate-limited API so you can check any MCP server's security score from your own tooling — CI gates that block low-grade servers, procurement reviews, or agent allow-lists — plus an enterprise track. Canopii is not itself an MCP server; it is trust infrastructure for choosing which MCP servers your agents should be allowed to talk to.
per month
Canopii MCP Trust Index delivers on its promises as a security tool. While it has some limitations, the benefits outweigh the drawbacks for most users in its target market.
A continuously scanned, security-scored registry of 16,000+ MCP servers, grading each version for tool poisoning, prompt injection, supply-chain, and credential risk.
Yes, Canopii MCP Trust Index is good for security work. Users particularly appreciate purpose-built for mcp-specific threats (tool poisoning, prompt injection) — not generic sca. However, keep in mind enterprise/api pricing is 'by request' — no self-serve tiers published.
Yes, Canopii MCP Trust Index offers a free tier. However, premium features unlock additional functionality for professional users.
Canopii MCP Trust Index is best for Vetting a third-party MCP server before adding it to Claude, Cursor, or another agent client and Building CI gates or allow-lists that block low-scored MCP servers. It's particularly useful for security professionals who need advanced features.
There are several security tools available. Compare features, pricing, and user reviews to find the best option for your needs.
Last verified March 2026