com.policylayer/registry

Measured conclusion: Alive, not deep-tested. L2 outcome: not_attempted.

The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "registry": {
      "url": "https://api.policylayer.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (5)

• check_mcp_server

  Check an MCP server against the PolicyLayer registry BEFORE installing or allowing it. Accepts a registry slug, an npm package name (scoped or not), a remote server URL (https://…), or a server name. Returns the full published record: identity verification with its evidence, risk grade, auth posture, freshness, and the tool surface listed riskiest-first. A server the registry does not know is queued for scanning by this very call — check back shortly.

  Parameters:

  • server (required) — string — Registry slug, npm package name (e.g. @acme/mcp-server), remote URL, or server name.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_mcp_stack

  Check a whole MCP stack against the PolicyLayer registry in one call — up to 25 servers, each given as candidate identifiers (npm package name, registry slug, or remote URL) tried in order until one resolves. Returns the published record for every hit — plus a deterministic verdict (attention signals and a suggested action) — and the lookup status for every miss; counts, grades and flagged tools come from the published records only. Costs one rate-limit unit per server.

  Parameters:

  • servers (required) — array — One entry per server in the stack.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• search_registry

  Search the PolicyLayer registry of published MCP servers by name, slug or package substring. Returns candidate matches with risk grade, identity confidence (verified / unverified / mismatch — mismatch means it claims to be an official server with no verifiable link to the brand) and tool count — follow up with check_mcp_server on the match you meant.

  Parameters:

  • query (required) — string — Substring to match against slug, name and packages.
  • limit — number — Max matches to return (1-20, default 10).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_tool

  One tool's full risk classification on a published MCP server: category, severity, risk analysis and evidence, OWASP classes, parameter schema and the recommended policy default. Use when deciding whether to allow a specific tool call, e.g. "should execute_sql on this server be permitted?"

  Parameters:

  • server (required) — string — Registry slug or npm package name of the server.
  • tool (required) — string — Tool name as the server declares it.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_change_events

  The registry change feed: tool-surface drift, auth-posture flips, impostor flags, version bumps — every event the freshness watchers emit, id-cursored so a consumer resumes exactly where it stopped. Requires a Registry Licence key (Authorization: Bearer plr_...); self-serve at https://policylayer.com/registry/pricing.

  Parameters:

  • limit — number — Max events (1-1000, default 200).
  • after_id — number — Return events with id greater than this cursor (default 0).
  • severity — string — Minimum severity: that level and above.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.