Connect your AI assistant to trustlists directory.
Search 4,034 public vendor records, check listed frameworks, and map project dependencies from Cursor, Claude, or any compatible MCP client.
npx -y @trustlists/mcpNo account. No API key.
Four ways to query public trust data
Each tool returns directory metadata and links back to a public source record.
- 01
trustlists_searchSearch the directoryFind public trust center records by company name or website domain.
Find the trust center for Linear - 02
trustlists_lookupLook up one vendorReturn an exact-domain match with its trust center, platform, listed frameworks, and source page.
Look up stripe.com - 03
trustlists_browseBrowse a focused setFilter by trust center platform, listed framework, or CSA STAR level.
Show SafeBase vendors that list ISO 27001 - 04
trustlists_audit_dependenciesMap project dependenciesRead common package manifests and map likely vendors to public security-documentation pages.
Check my package.json for vendor trust centers
Add it to your MCP client
Save this server configuration, restart your client, and ask a normal vendor question.
- 1Open your MCP configuration
Use Cursor settings, Claude Desktop, Claude Code, or another MCP client.
- 2Add the trustlists server
Copy the configuration shown here and save the file.
- 3Restart and ask
The four trustlists tools will appear in your client.
{
"mcpServers": {
"trustlists": {
"command": "npx",
"args": ["-y", "@trustlists/mcp"]
}
}
}Before you connect
Is it really free?
Yes. Search, lookup, browse, and dependency mapping use the public directory with no account, API key, or credits.
Does it send my source code anywhere?
The dependency tool reads supported manifest files to identify package names. It does not upload your project or perform a source-code security scan.
Is this the SOC 2 Analyzer?
No. The MCP package exposes free public-directory tools. SOC 2 report analysis is an account-based workflow in trustlists Companion.
What happens when a vendor is not listed?
The tool reports that there is no current directory match. That does not prove the vendor lacks security documentation. Check the vendor's own site or submit a missing trust center.