MCP TrustOps for security teams

Detect risky agent tools before deployment and separate security probes from product analytics.

Audience

Security teams

Primary API

/v1/servers/{namespace}/{name}/trustops

Policy exports

JSON, Rego, YAML, CI

Use cases

Review write-action governance, scopes, auth boundary, and overbroad access risk.
Track dependency, artifact, maintainer, and release-signing scan coverage.
Generate OPA, YAML allowlist, CI, and gateway policy exports.

Reports expose tool-level risk inventory and write-action governance.
Security probe traffic is classified separately from product analytics.
TrustOps profiles flag metadata-only supply-chain scans versus deep artifact scanning.

Flow

risk inventory -> OPA export -> gateway rule

Sample output

package mcp.verify

allow := false
requires_human_approval := true
blocked_tools := {"submit_feedback", "score_batch"}
max_risk := "medium"