# H/M MCP Trust

H/M MCP Trust is a free browser-local structural inspector for declarations used before an AI agent installs or connects to an MCP server.

- Human interface: https://hogarmas.net/mcp-trust/
- Export schema: https://hogarmas.net/mcp-trust/schema.json
- Check catalog: https://hogarmas.net/mcp-trust/checks.json
- Ruleset: `2026-07-21.1`
- Analysis schema: `hm.mcp-trust.analysis.v1`
- Export schema: `hm.mcp-trust.v1`

## Why it exists

An MCP server identity, its source repository, distributed package, remote endpoint and authorization metadata form separate trust claims. A familiar display name does not prove that those claims still refer to the same system.

H/M MCP Trust cross-checks supplied declarations before connection. It does not connect to the server and does not turn metadata into a security badge.

## Accepted inputs

1. `server.json`-compatible MCP Registry declaration. Required.
2. OAuth 2.0 Protected Resource Metadata from RFC 9728. Optional, but expected when the operator declares a protected remote server.
3. OAuth Authorization Server Metadata compatible with RFC 8414 or OpenID Connect discovery. Optional, but needed for local issuer, endpoint, protected-resource and PKCE cross-checks.

Users may paste JSON or load local `.json` files. The interface accepts at most 500 KB per document.

The selected access mode is one of:

- `unknown`
- `public`
- `protected`

## Inspection dimensions

- `identity`: namespaced server identity, repository owner and custom-domain alignment.
- `distribution`: repository declaration, package registry, version relationship and OCI digest pinning.
- `transport`: package or remote entrypoint, transport type, HTTPS and private-network boundaries.
- `authorization`: protected resource identifier, authorization-server list, issuer, endpoints, scopes, bearer methods, protected-resource cross-reference and PKCE S256 declaration.
- `secrets`: pattern-based observations for accidental credentials in defaults, arguments, fields and URLs.

## Decision vocabulary

- `review-required`: at least one critical or high structural observation exists.
- `incomplete-evidence`: no critical or high observation exists, but medium observations or uncovered dimensions remain.
- `contract-consistent`: no listed structural conflict was observed in the supplied declarations.

`contract-consistent` is not a security certification. It does not mean the package, repository, endpoint, owner or runtime is safe.

## Privacy and network boundary

All supplied documents are parsed and hashed in the browser.

- No document is uploaded to H/M.
- No URL found inside an input is fetched.
- No server is contacted.
- No package, repository, model or tool is executed.
- No browser storage is used for source documents.
- Export files exclude raw documents, raw values, URLs, server names, filenames and secret values.
- Metrics never contain document contents, URLs, server names, filenames, hashes, rule paths, findings or secret values.
- Synthetic examples are explicitly labeled and counted separately from manual inspections.

The only network request made by the browser runtime is a fixed anonymous page/action metric to `/api/metrics`. Automated browser QA is excluded with `navigator.webdriver`.

## Export

The JSON export contains:

- the SHA-256 digest of the stable local input bundle;
- document-presence booleans;
- normalized package and transport type sets;
- decision and severity counts;
- five dimension states;
- rule IDs, severity, confidence, JSON Pointer paths and primary standards;
- explicit false-valued limitations.

The export does not contain the source documents or their values. The Markdown export follows the same minimized boundary.

## Deliberate limits

- The tool does not fetch the official JSON Schema and does not claim full `server.json` schema validation.
- The tool is not the official MCP Registry publisher validator.
- Registry namespace ownership is not verified.
- DNS resolution, redirect chains, HTTP response headers and live endpoint identity are not observed.
- Package contents, source code, dependencies, signatures, SLSA attestations and runtime behavior are not inspected.
- Signed OAuth metadata can be detected as present, but its signature is not verified.
- Secret detection is pattern-based and is not a credential scanner guarantee.
- The check catalog is finite and does not guarantee complete threat coverage.

## Relationship to other H/M tools

- Use [H/M Agent Scope](https://hogarmas.net/agent-scope/) to inspect the declared authority of a tool catalog.
- Use [H/M Agent Risk Atlas](https://hogarmas.net/agent-risk-atlas/) to map capability combinations to known attack paths.
- Use [H/M Agent Drift](https://hogarmas.net/agent-drift/) to compare authority reports between releases.
- Use H/M MCP Trust before those steps to inspect the server identity, distribution and authorization contract itself.

## Primary references

- [MCP Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
- [MCP Authorization specification, 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)
- [Official MCP Registry server.json format](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/generic-server-json.md)
- [RFC 9728: OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728)
- [SLSA Provenance](https://slsa.dev/spec/v1.1/provenance)