About UND Assay
Evidence about AI tools, before you install them.
UND Assay is a public registry of evidence about the tools AI assistants connect to: MCP servers and web APIs. Before you or your AI install one, it shows who published it, where its code comes from, whether its package has known vulnerabilities, whether installing it runs scripts, and what changed between versions. Every statement links to the public record it came from, with the time we fetched it and a SHA-256 hash, so you can check it yourself.
Why it exists
An MCP server can read your files, call services and act with your credentials once an assistant installs it. Anyone can publish one, under almost any name, and most catalogs list tools without saying who stands behind them or what changed since last week. UND Assay reads the public record and says plainly what it shows and what it does not.
How it works
- We collect tools from public registries, package indexes and code hosts and combine them into one entry per tool. The catalog is updated every hour.
- For each analyzed server we run the checks described on the Methodology page: publisher identity, repository ownership, artifact provenance, install scripts, known vulnerabilities, maintenance and license.
- Each result has one of five states: Verified, Claimed, Contradicted, Stale or Unknown. "Not analyzed" is never shown as verified, and a tool found only in a directory is marked Listed until our checks run on it.
- Each published data snapshot is signed, and a hash-chained log of every snapshot is public, so earlier data cannot be quietly rewritten.
What we never do
- We never call a tool "safe". No warnings means the checks that ran raised nothing.
- We never run, install or change the tools we describe on your machines or on our own systems; packages run only in the separate test machine described under Sandbox run. Text written by a tool's publisher is shown as their own, unverified words.
- Payment never changes a state, a ranking or a finding.
How it is paid for
Browsing and searching are free. Paid plans add higher limits, watched tools and change alerts, and have no ads. For everyone else, Google ads appear on some pages, listed in the Privacy Notice; they never appear inside evidence and never affect what we show. People and AI assistants can also query the same evidence through our MCP server and REST API.
Who runs it
UND Assay is built and operated by Universal Network Development LLC (UND Industries), a Florida limited liability company. The documents that govern the service are on the Terms & policies page, and how the service is built and secured is on the Security page.
Contact
- Questions, corrections and objections: [email protected]. Publishers can also open a dispute on any statement.
- Security reports: [email protected].
- Mail: Universal Network Development LLC, PO Box 560422, Orlando, FL 32856-0422.