trustlists
Find public vendor trust centers, analyze SOC 2 reports, and request trust-center access.
Installation
Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).
@trustlists/mcpclaude mcp add trustlists -- npx -y @trustlists/mcp@0.3.0{
"mcpServers": {
"trustlists": {
"command": "npx",
"args": [
"-y",
"@trustlists/mcp@0.3.0"
]
}
}
}Documentation
Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.
Sommaire
trustlists_ Plugin
Public vendor trust center tools for Cursor and Claude Code.
Find trust centers, analyze SOC 2 reports, and request vendor access without leaving your editor.
What it does
The trustlists_ plugin gives your AI assistant access to thousands of public company trust center records, local SOC 2 analysis, and SafeBase/Vanta access requests.
Tools
| Tool | What it does | Cost |
|---|---|---|
trustlists_search | Search thousands of trust centers by name or domain | Free |
trustlists_lookup | Look up a single vendor by exact domain | Free |
trustlists_browse | Filter by platform, listed framework, or CSA STAR level | Free |
trustlists_audit_dependencies | Audit package.json, requirements.txt, go.mod, etc. | Free |
trustlists_login / whoami / logout | Device-code sign-in (~/.trustlists/auth.json) | Free |
trustlists_soc2_analyze / status / report | Analyze local SOC 2 PDFs after a credit preview | Credits |
trustlists_requester_profile | Identity used on vendor access forms | Free |
trustlists_access_request / status / continue / request_batch | Request SafeBase or Vanta access (max 5 per batch) | Free (beta) |
Hosted endpoint (ChatGPT and other remote clients)
https://mcp.trustlists.org/mcp serves the same tools over Streamable HTTP after
an OAuth sign-in with a trustlists account (Google or Microsoft). Connecting the
app replaces trustlists_login and trustlists_logout. Because a hosted server
cannot read your disk, the dependency audit takes pasted manifest text, and SOC 2
PDFs are uploaded in the trustlists app via trustlists_soc2_upload.
Skills
The plugin ships with skills your AI assistant uses automatically:
- lookup-vendor - Find a vendor's trust center and listed frameworks
- audit-dependencies - Map project dependencies to public trust center records
- compliance-quick-check - Check whether a directory record lists a requested framework
- sign-in - Connect a trustlists account with a device code
- analyze-soc2 - Preview credits, then analyze a local SOC 2 PDF
- request-trust-center-access - Complete the requester profile and request access
Example usage
In Cursor or Claude Code, just ask:
"Look up Stripe's trust center"
"Audit my package.json for vendor security"
"Does Datadog's trust center list HIPAA information?"
The AI uses the plugin's tools to answer with current public trustlists data. A directory record is a discovery aid, not an audit, certification, endorsement, or security rating.
Quick Install (Cursor, Claude Desktop, Claude Code)
Add this to your MCP config and restart:
{
"mcpServers": {
"trustlists": {
"command": "npx",
"args": ["-y", "@trustlists/mcp"]
}
}
}| App | Config location |
|---|---|
| Cursor | Settings → MCP → Edit config (or ~/.cursor/mcp.json) |
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Claude Code | ~/.claude/settings.json or .claude/settings.json in your project |
Full installation guide → (includes troubleshooting)
Pricing
The directory and audit tools are free and require no trustlists account. SOC 2 analysis and access requests use a device-code login on the local MCP.
- Free MCP tools - Search, lookup, browse, and dependency mapping
- Signed-in MCP tools - SOC 2 analysis (credits) and trust-center access requests
- Companion - The same account workflows in the browser at app.trustlists.org
Visit the MCP overview for setup and tool details, or trustlists.org for the full directory and Companion subscriptions.
Development
# Install dependencies
npm install
# Build the MCP server
npm run build
# Test locally
npm run test:localSee docs/development.md for the full development guide.
License
Apache 2.0. See LICENSE and NOTICE.
Links
Questions fréquentes
Qu'est-ce que trustlists ?
Find public vendor trust centers, analyze SOC 2 reports, and request trust-center access.
Comment installer trustlists ?
Il s'exécute sur votre machine. Dans Claude Code : claude mcp add trustlists -- npx -y @trustlists/mcp@0.3.0. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.
Faut-il une clé API pour trustlists ?
Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.
trustlists est-il open source ?
Oui. Son code est sur GitHub sous licence Apache-2.0.
Qui maintient trustlists ?
Il est publié par trustlists. AI.tn le référence sans le maintenir ni le recommander.
Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.