com.policylayer/registry

com.policylayer/registry · v1.0.1

No registry update 90+ days

Measured by MCP Station

Last check	Reachable
Checked at	—
Check success 7 / 30 days	—
First-try success 30 days	—
Median response	—
Lookups 30 days	—
Authentication	No auth
MCP version	2025-06-18
Rank score	—
Declared risk	Not declared (tools carry no read/destructive hints)
Capabilities declared	tools
Tool definitions	5 tools · with description 100% · input schema is an object 100% · read/destructive hints 0%

Description written by the publisher, not verified

The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.

Connect

streamable-http · https://api.policylayer.com/mcp

claude mcp add --transport http registry https://api.policylayer.com/mcp

{
  "mcpServers": {
    "registry": {
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Tools as reported by the server

check_mcp_server
Check an MCP server against the PolicyLayer registry BEFORE installing or allowing it. Accepts a registry slug, an npm package name (scoped or not), a remote server URL (https://…), or a server name. Returns the full published record: identity verification with its evidence, risk grade, auth posture
check_mcp_stack
Check a whole MCP stack against the PolicyLayer registry in one call — up to 25 servers, each given as candidate identifiers (npm package name, registry slug, or remote URL) tried in order until one resolves. Returns the published record for every hit — plus a deterministic verdict (attention signal
search_registry
Search the PolicyLayer registry of published MCP servers by name, slug or package substring. Returns candidate matches with risk grade, identity confidence (verified / unverified / mismatch — mismatch means it claims to be an official server with no verifiable link to the brand) and tool count — fol
check_tool
One tool's full risk classification on a published MCP server: category, severity, risk analysis and evidence, OWASP classes, parameter schema and the recommended policy default. Use when deciding whether to allow a specific tool call, e.g. "should execute_sql on this server be permitted?"
get_change_events
The registry change feed: tool-surface drift, auth-posture flips, impostor flags, version bumps — every event the freshness watchers emit, id-cursored so a consumer resumes exactly where it stopped. Requires a Registry Licence key (Authorization: Bearer plr_...); self-serve at https://policylayer.co

Repository · Website · JSON · Text for agents · Registry updated 2026-07-08