mcp-registry/com.filltrust/questions · v1.0.0
As of 2026-10-26 12:13 UTC, the Filltrust Questions MCP server is up with a Glimind reliability score of 96/100 (grade A). Over the last 30 days it answered 100% of Glimind's liveness checks. It had 1 outage in 90 days, with a median recovery of 7 minutes.
Guidance for answering vendor security questionnaires. Every result carries the page it came from.
Claude Code
claude mcp add --transport http filltrust-questions-mcp-server https://www.filltrust.com/api/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"filltrust-questions-mcp-server": {
"type": "http",
"url": "https://www.filltrust.com/api/mcp"
}
}
}
Third-party server, listed as discovered. Review its source before installing.
5 of 5 tool(s) carry no readOnlyHint/destructiveHint annotations.
Annotate read-only tools with {"readOnlyHint": true}. Agents and gateways can then run them without a confirmation prompt, and route around destructive ones. How to fix →
No tool declares an outputSchema.
Declare outputSchema and return structuredContent (MCP 2025-06-18+). Agents can then parse results without guessing, and chain tools reliably. How to fix →
Paste-ready definitions with the problems above fixed. Changes marked verify need a human look. All of them as JSON: /v1/readiness/mcp-registry%2Fcom.filltrust%2Fquestions/fixes
{
"name": "get_filltrust_posture",
"description": "FillTrust's own answers to the questions it exists to answer, for anyone assessing it as a vendor. Includes the answers that are \"no\".",
"inputSchema": {
"type": "object",
"properties": {}
},
"annotations": {
"readOnlyHint": true
},
"title": "Read FillTrust's own security posture"
}{
"name": "get_question",
"description": "The complete published guidance for one questionnaire question: what it is really asking, which of your documents answers it, what evidence to attach, a model answer with the specifics left blank, the ways it usually goes wrong, and the standards that ask it with their verified control references.",
"inputSchema": {
"type": "object",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug from a search_questions result, for example \"encryption-at-rest\"."
}
}
},
"annotations": {
"readOnlyHint": true
},
"title": "Read one question's guidance in full"
}{
"name": "get_questionnaire_statistics",
"description": "Measured counts from 146 real vendor security questionnaires (17,697 questions) published by universities, purchasing consortia and companies: which topics are asked most, and detailed profiles of the questionnaires that have a name people use, such as HECVAT and CAIQ. Use this when asked what a security questionnaire contains, how long one is, or what a named questionnaire asks about. These are counts from real files rather than an estimate.",
"inputSchema": {
"type": "object",
"properties": {
"questionnaire": {
"type": "string",
"description": "Optional. A named questionnaire to profile, for example \"HECVAT\" or \"CAIQ\". Omit for the corpus-wide topic counts."
}
}
},
"annotations": {
"readOnlyHint": true
},
"title": "What security questionnaires actually ask, measured"
}Get an email or webhook when this server's readiness drops by 10+ points, tool-poisoning text appears, or a tool breaks:
curl -X POST https://glimind.com/v1/subscriptions -H 'content-type: application/json' -d '{"tools":["mcp-registry/com.filltrust/questions"],"email":"[email protected]"}'Agents: watch_tool({"toolId": "mcp-registry/com.filltrust/questions"}) over MCP.
get_questionnaire_statistics ~200 tokenssearch_questions ~163 tokensget_question ~146 tokenslist_standards ~86 tokensget_filltrust_posture ~65 tokensStatic checks of the advertised tools/list (schema, descriptions, annotations, tool-poisoning patterns, names, size) plus observed protocol, uptime, latency and contract changes. Read-only: no tool is ever called. Weights: schema 15, docs 20, safety 15, efficiency 15, compatibility 15, protocol 5, reliability 10, stability 5. Token counts are estimates (~3.6 characters per token).
Operator? Fix these, then re-check live. Embed the readiness badge:
[](https://glimind.com/server/mcp-registry%2Fcom.filltrust%2Fquestions?ref=badge)
<a href="https://glimind.com/server/mcp-registry%2Fcom.filltrust%2Fquestions?ref=badge"><img src="https://glimind.com/v1/readiness/badge/mcp-registry%2Fcom.filltrust%2Fquestions.svg" alt="MCP agent-readiness"></a>
.. image:: https://glimind.com/v1/readiness/badge/mcp-registry%2Fcom.filltrust%2Fquestions.svg :target: https://glimind.com/server/mcp-registry%2Fcom.filltrust%2Fquestions?ref=badge :alt: MCP agent-readiness
Glimind records every version of this server's tool definitions in a signed, append-only transparency log. Current manifest sha256:4782e64e02e511d6…, first seen 2026-10-17, included at leaf 5770 of 72,742. Version history · verify what your client received.
Compare: most reliable knowledge servers · most reliable data servers · most reliable retrieval servers
Glimind tells agents whether a server is up right now and how to call it, then fails over to a live alternative when it isn't.
Claude Code
claude mcp add --transport http glimind https://glimind.com/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"glimind": {
"type": "http",
"url": "https://glimind.com/mcp"
}
}
}
As of 2026-10-26 12:13 UTC, the Filltrust Questions MCP server is up with a Glimind reliability score of 96/100 (grade A). Over the last 30 days it answered 100% of Glimind's liveness checks. It had 1 outage in 90 days, with a median recovery of 7 minutes.
Filltrust Questions MCP server advertises 5 tools, including get_filltrust_posture, get_question, get_questionnaire_statistics, list_standards, search_questions.
Point your MCP client at this streamable-http endpoint: https://www.filltrust.com/api/mcp
Glimind scanned all 5 tool definitions for tool-poisoning patterns — hidden or invisible characters, instructions that override the model, concealment from the user, requests to read credential or MCP config files, conversation exfiltration and cross-tool shadowing — and found none. This checks what the server tells the model, not what its code does; review the source before granting access to sensitive data.
Status page: 90-day uptime, every outage and how long it lasted.
Claim this listing to get the Verified operator marker, a remediation checklist and owner analytics, or embed the live badge from any of the tool pages above. Maintainers: alerts, deploy attestation and monthly reports.
Status is an automated estimate from Glimind's liveness checks (handshake and tool listing only; no tool is ever called) and may lag or differ from your network. Glimind is not affiliated with this server or its operator. Operator? Request a correction or opt out at https://glimind.com/opt-out.