AI Tool

OpenTrustBench Review

OpenTrustBench is a free, local-first security scanner for AI agents and MCP servers, providing a trust score with zero data leaving your machine.

shipped Sep 16, 2026free

Why it matters

1Offers a free CLI tier for unlimited use.

2Runs eight static security rules locally, ensuring zero data leaves the machine.

3Generates a Trust Card graded A–F for AI agents and MCP servers.

4Automatically maps findings to OWASP Agentic AI Top 10 and OWASP LLM Top 10 (2025).

About OpenTrustBench

Business Model

Open Source

Funding

Bootstrapped

Platforms

Web, CLI

Target Audience

Developers and security auditors of AI agents and MCP servers

Pricing Plans

CLI

$0, forever

• Unlimited local scans
• Trust Cards
• Bound badges
• SARIF

EXPERT REVIEW

Scoped per target

• Manual triage of results
• Remediation plan on request
• Contact us for details

ENTERPRISE

Custom

• Custom rules
• Evidence helpers
• Priority support
• Contact us for details

GitHubOpen Source

overview

What is OpenTrustBench?

OpenTrustBench is an AI security scanner tool developed by Eulogik that enables developers and security auditors of AI agents and MCP servers to identify vulnerabilities and assess trustworthiness. It provides a comprehensive suite of tools to identify vulnerabilities and ensure the safe deployment of autonomous AI systems, operating entirely locally with zero telemetry.

features

Key Features of OpenTrustBench

OpenTrustBench provides a robust set of features designed for comprehensive security assessment of AI agents and Model Context Protocol (MCP) servers, emphasizing local operation and transparency.

Local-first security scanning, ensuring zero bytes of code leave the user's machine.
Generates a Trust Card with a definitive letter grade (A–F) for AI agent code.
Runs eight static security rules to detect common vulnerabilities.
Extracts a permission manifest to detail an AI agent's authorized actions.
Maps all discovered findings to the OWASP Agentic AI Top 10 and OWASP LLM Top 10 (2025).
Supports scanning of local directories, GitHub URLs, and npm packages.
Audits npm dependencies recursively for supply chain security.
Operates in a simulation mode to prevent accidental execution of malicious payloads.

use cases

Who Should Use OpenTrustBench?

OpenTrustBench is designed for specific personas and teams involved in the development, deployment, and auditing of AI agents and MCP servers, providing critical security insights.

DevOps teams: To protect CI pipelines from vulnerable AI agents or MCP servers by integrating security checks.
Security professionals: For auditing AI agents and MCP servers to identify critical security issues like shell injections, secret leaks, and prompt injection vulnerabilities.
Developers building with autonomous AI: To ensure the security posture of their AI agents before deployment.
Developers using Model Context Protocol (MCP) servers: To assess and improve the security of their MCP server implementations.
Auditors: To generate a Trust Card with a definitive letter grade, providing concrete evidence of AI security to users or regulatory bodies.

how to use

How to Use OpenTrustBench

OpenTrustBench is primarily used via its command-line interface (CLI) to perform local security scans on AI agents and MCP servers, providing immediate feedback on potential vulnerabilities.

1Install the OpenTrustBench CLI tool on your local machine.
2Navigate to the directory containing your AI agent or MCP server code.
3Execute a scan command, specifying the target (e.g., local directory, GitHub URL, npm package).
4Review the generated Trust Card and detailed findings, which are mapped to OWASP standards.
5Address identified vulnerabilities based on the scan report and permission manifest.
6Integrate the scanner into CI/CD pipelines to automate security checks during development.

pricing

OpenTrustBench Pricing & Plans

OpenTrustBench offers a free, open-source CLI tool for continuous security scanning, alongside specialized services for expert review and enterprise-level needs.

CLI: $0, forever – Provides full access to the local-first security scanner.
EXPERT REVIEW: Scoped per target – Tailored security assessments by OpenTrustBench specialists.
ENTERPRISE: Custom – Bespoke solutions for larger organizations with specific security requirements.

Enjoying this? Get one like it in your inbox each morning.

one email a day · unsubscribe in two clicks · no third-party tracking

Pros

+Completely free CLI tier available forever under an Apache 2.0 license.
+Operates locally with zero telemetry, ensuring no code or data leaves the user's machine.
+Provides a clear, definitive Trust Card (A–F grade) for quick security assessment.
+Automatically maps findings to industry-recognized OWASP Agentic AI Top 10 and OWASP LLM Top 10 (2025).
+Identifies critical security issues such as shell injections, secret leaks, and prompt injection vulnerabilities.
+Supports integration into CI/CD pipelines to prevent vulnerable AI agents from reaching production.

Cons

−Primarily focused on static analysis, which may not detect all runtime or behavioral vulnerabilities.
−Does not perform active exploitation or red-teaming, unlike some advanced AI pentesting platforms.
−Specific user reviews or testimonials are not widely available in public search results.
−Requires local installation and management of the CLI tool, which might be less convenient than cloud-based SaaS solutions for some users.

Similar Tools

OpenTrustBench vs Competitors

OpenTrustBench distinguishes itself in the AI security landscape through its open-source, local-first approach, and specific focus on AI agents and MCP servers, contrasting with broader or more active pentesting solutions.

0DIN Scanner↗

Monitors, tracks, and analyzes vulnerabilities in Generative AI and Agentic models, focusing on issues like jailbreaks and prompt injection.

While OpenTrustBench provides static analysis and a Trust Card for AI agents and MCP servers, 0DIN Scanner is more focused on red-teaming and finding behavioral vulnerabilities in LLMs and agentic models, which might complement or extend beyond OpenTrustBench's static analysis.

Ship Safe↗

Orchestrates multiple specialized AI agents to perform local security scans on codebases, detecting various vulnerabilities like secrets, injections, and LLM red teaming issues.

Ship Safe is a local, free security scanner for code, similar to OpenTrustBench, but it uses an ensemble of AI agents for broader code vulnerability detection rather than OpenTrustBench's specific static rules and permission manifest for AI agents and MCP servers.

Semgrep (with AI Security Ruleset)On Stork

A fast, open-source static analysis tool that allows for highly customizable rules, including specific rulesets designed for AI security vulnerabilities.

Semgrep is a general-purpose static analysis tool that requires specific AI security rulesets to match OpenTrustBench's AI-focused scanning. It offers greater flexibility and customizability but might require more configuration than OpenTrustBench's out-of-the-box AI agent and MCP server checks.

AI Agent Defense Kit↗

Provides a collection of modular 'security skills' for AI agents, including auditing skills before installation and checking dependencies for supply chain attacks.

OpenTrustBench offers a consolidated static scan for AI agents and MCP servers, issuing a Trust Card. AI Agent Defense Kit provides a more granular, modular set of tools for auditing and protecting AI agents, some of which are static checks, but it's presented as a 'kit' of skills rather than a single scanner.

See every OpenTrustBench alternative, compared→

Related AI Tools

Other tools in this category, matched by shared tags

Fantasy Football AI Weekly Recaps Rubbletag TerzyApp DocChief AI nuemed All the best AI. One workspace.

Visit OpenTrustBench↗

Connect

⌘

GitHubgithub.com/eulogik/OpenTrustBench