I gave my own repo a security grade of F (and that's the point)

Everyone's installing MCP servers the way we installed browser toolbars in 2005: quickly, and without reading them. Shell access, file access, API keys — handed over on vibes.

I was doing it too. So I spent my weekends building Open Trust Bench, and then I turned it on my own repo.

It gave me an F.

Wait, why is that good?

Because my repo contains a deliberately vulnerable test fixture and attack strings inside unit tests. A scanner that passed its own ammunition would be worthless. The CLI we actually ship grades A (90/100).

That one result is the whole philosophy: a trust tool that flatters you is lying to you.

What it is

OpenTrustBench — point it at any AI agent or MCP server, get a Trust Card graded A–F in seconds:

bash
npx @opentrustbench/cli scan .