Skip to content
Agent Supply Trust

MCP server security verdict API

Turn an MCP server descriptor into a policy verdict

Supply the descriptor your registry already has. Agent Supply Trust evaluates provenance, permissions, and instruction risks against a versioned policy.

Run the keyless demo Create a sandbox key
Customer-supplied input No key for the demo No card for a sandbox account

Exact use case

An MCP server, package, skill, or plugin is about to enter an agent tool registry and needs a repeatable admission decision.

Input you provide

A customer-supplied component descriptor with kind, version, provenance, permissions, and instructions.

Output you receive

Evidence, component digest, policy version, and an allow, warn, or deny verdict.

What the API does

Evaluates supplied descriptors and binds each result to the component digest and policy version used.

Authenticated first value

A successful authenticated POST /v1/scans or policy-applied POST /v1/verdicts that returns a completed risk or verdict result.

OpenAPI-grounded keyless demo

Scan the descriptor

Edit the supplied example, send it to /v1/demo/scan, and inspect the service’s unedited JSON response. The demo stores nothing and consumes no account quota.

Request body Ready

This sample matches the published request contract for /v1/demo/scan. Do not paste secrets or personal data.

Response
Run the demo to see the API response.

A successful response demonstrates the bounded classification or calculation shown here. It is not evidence of a deployed connector, autonomous external action, customer outcome, or commercial performance.

Capability boundary

What this page does not promise

It does not fetch repositories, enumerate live MCP servers, block runtime traffic, or provide a native GitHub Action or CI gate.

  • The demo qualifies the transformation only; account verification, key creation, and a successful authenticated primary-value request are required for activation.
  • Inputs and outputs must be reviewed in the context of your own data rights, policies, and operational controls.
  • No ranking, accuracy, savings, recovery, prevention, customer, or revenue result is claimed.

From evaluation to first value

A short, explicit path

  1. Run the keyless demo.

    Confirm that the input and output shape match the job you need done.

  2. Create and verify a sandbox account.

    The email claim flow creates a product-scoped API key. No card is required for the free tier.

  3. Call the authenticated primary-value operation.

    A successful authenticated POST /v1/scans or policy-applied POST /v1/verdicts that returns a completed risk or verdict result.

Create a sandbox key Read the API reference