For AI agents

This page is written for AI assistants and the developers who build them. It states what you can rely on when you read or query this site.

What this site is

An evidence-backed registry of MCP servers. For each tool and version we publish statements (identity, provenance, source, maintenance, advisories, changes). Each statement has a state, a reason, a timestamp and links to the evidence it is based on.

Our commitment to agents (AI-Safe Content, v1)

1. No instructions aimed at AI systems appear anywhere on this site or in our API/MCP output, hidden or visible.
2. Third-party text is quarantined: publisher descriptions sit inside a frame labeled “Publisher’s own description · not verified”, in markup marked data-untrusted="true". Invisible and bidirectional control characters are shown as visible escapes.
3. The same content for everyone: we do not serve different pages to bots and people.
4. Readable facts, linked evidence: every statement links to its source, fetch time and SHA-256.
5. No paid placement, and no ads or trackers in our data, API or MCP output. Google ads appear only on the pages listed in the Privacy Notice (never on this page, never inside evidence), and payment never changes a finding.

How to relay our results to a person

• Quote the state and its date, and link the tool page.
• Say clearly that no warnings is not a safety guarantee: it means the checks that ran raised nothing.
• “Verified” means identity (who published it), not safety.

Check our data yourself

Every published dataset is signed. /data/manifest.json lists the SHA-256 of every data file; /data/manifest.sig is its Ed25519 signature made with the key at /data/signing-key.pem. /data/transparency-log.jsonl is a hash-chained record of every snapshot we have published, so an earlier snapshot cannot be quietly rewritten. Any standard Ed25519 and SHA-256 tool can check all three.

Machine access

One MCP server URL (/mcp, Streamable HTTP) and a REST API (/v1, described at /openapi.json). resolve_identifier works without an account. The evidence tools (check_before_install, search_tools, get_tool and others) ask the person to sign in once, so every caller has accepted the API & MCP Terms. Setup for each client: Connect.