Getting Started

Secure your first MCP server in under 3 minutes

This guide will walk you through installing the CLI, scanning a local server, and creating your first signature.

Prerequisites

  • Go 1.23+ installed (for building from source, or download precompiled binary)
  • An MCP server to test with (e.g., npx @modelcontextprotocol/server-filesystem)

1. Install the CLI

go install github.com/mcptrust/mcptrust/cmd/mcptrust@latest

Verify installation:

mcptrust --version

2. Generate Keys

Create an Ed25519 keypair. This is your "Authority" identity.

mcptrust keygen
# Created private.key (KEEP SECRET!)
# Created public.key (Share with verifiers)

[!WARNING] Never commit private.key to git! Add it to your .gitignore immediately.

3. Lock a Server

Let's lock the filesystem server. Run:

mcptrust lock -- "npx -y @modelcontextprotocol/server-filesystem /tmp"

This will:

  1. Start the server.
  2. Query its capabilities.
  3. Write mcp-lock.json to your current directory.

4. Approve (Sign)

Sign the lockfile to approve this state.

mcptrust sign
# Created mcp-lock.json.sig

5. Verify

Now, anyone with public.key can verify that the lockfile is trusted and hasn't changed.

mcptrust verify
# ✅ Signature Verified

Next Steps