1. Join identity to distribution
Compare the namespaced server name with repository ownership, package identity, version and remote endpoint. A mismatch does not prove abuse, but it requires an explanation before install or connection.
2. Reject dangerous network boundaries
Declared URLs should use HTTPS and avoid loopback, private, link-local and metadata-service destinations. The inspector never opens them; it marks the boundary for independent review.
3. Trace the protected resource
For a protected server, RFC 9728 metadata should identify the exact resource and publish at least one authorization server. The resource, issuer and endpoints should form one consistent chain.
4. Require a defensible OAuth flow
Review authorization_endpoint, token_endpoint, scopes, bearer-token transport methods and PKCE S256 support. Missing or excessively broad declarations require an explicit decision.
5. Separate consistency from provenance
A consistent contract does not verify DNS, ownership, signatures, package contents, implementation or runtime behavior. Provenance and isolation need independent evidence.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does MCP Trust connect to the server?
No. It analyzes only supplied JSON documents inside the browser and does not fetch any URL found in them.
Does contract-consistent mean the server is safe?
No. It means the published structural rules found no contradiction. It is not a security certification.
Are server names, URLs or secrets stored?
No. Reports and metrics omit documents, values, URLs, server names, filenames and secret values.