LaunchTrust

Measured conclusion: Alive, not deep-tested. L2 outcome: not_attempted.

Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "LaunchTrust": {
      "url": "https://mcp.launchtrust.co/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (9)

• scan_url read-only

  Run a FREE LaunchTrust compliance + security quick-scan on a public web URL. Returns a focused SUBSET of checks — leaked frontend secrets/API keys, exposed .env//.git, security headers, HTTPS/HSTS, missing privacy/terms pages, trackers/cookie banner, and AI-interaction disclosure. The result is unsigned and not stored. The full 27-detector signed, dated, continuously-monitored scan requires a LaunchTrust account. Compliance aid, not legal advice.

  Parameters:

  • url (required) — string — Public http(s) URL to scan, e.g. https://example.com

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• list_jurisdictions read-only

  List the jurisdictions and categories LaunchTrust tracks (e.g. EU AI Act, GDPR, US state privacy laws, app-store policies). Public coverage registry. Compliance aid, not legal advice.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• get_compliance_rules read-only

  Fetch LaunchTrust's sourced, founder-reviewed compliance rule snapshots, optionally filtered to one jurisdiction code (e.g. eu-ai-act-50, gdpr, ca-sb243). Compliance aid, not legal advice.

  Parameters:

  • jurisdiction — string — Optional jurisdiction code to filter by, e.g. gdpr or eu-ai-act-50.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• verify_record read-only

  Independently verify the ECDSA (ES256) signature on a LaunchTrust signed scan/disclosure record against the published public key. Pass the record JSON (the downloaded record, or an object containing `canonical` and `signature`).

  Parameters:

  • record (required) — object — The LaunchTrust signed record JSON (or an object with `canonical` + `signature`).

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• list_my_apps read-only

  List the apps registered in your LaunchTrust account, with each one's latest scan status. Requires a LaunchTrust token.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• register_app

  Register a web URL in your LaunchTrust account so it can be fully scanned and monitored. Idempotent — if the URL is already registered, returns the existing app. Requires a LaunchTrust token and an active subscription.

  Parameters:

  • url (required) — string — Public https URL of the app to register.
  • name — string — Optional label (defaults to the hostname).

  Hints: read-only no · destructive no · idempotent yes · open-world yes

• scan_app

  Run the full LaunchTrust scan on one of your registered apps and store a signed, dated evidence record. Requires a LaunchTrust token and an active subscription. Limited to 5 scans per app per day.

  Parameters:

  • app_id (required) — string — The id of a registered app (see list_my_apps or register_app).

  Hints: read-only no · destructive no · idempotent no · open-world yes

• get_scan_history read-only

  List recent scans (summary + findings) for one of your registered apps. Requires a LaunchTrust token.

  Parameters:

  • app_id (required) — string — The id of a registered app.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

• get_market_report read-only

  Get the latest scan for one of your registered apps, with each finding annotated by the jurisdictions and rules applicable to that app's target markets. Requires a LaunchTrust token.

  Parameters:

  • app_id (required) — string — The id of a registered app.

  Hints: read-only yes · destructive no · idempotent yes · open-world yes

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.