{"site":{"name":"MCP Risk","tagline":"Approve MCPs once. Know when they change.","description":"Evidence-backed trust profiles for MCP repos and configs. Approve a known-good state and monitor what changes.","url":"http://localhost:3000"},"hero":{"headline":"Know what your agents can run before they run it.","sub":"MCP Risk creates evidence-backed trust profiles for MCP repos and configs, so teams can approve a known-good state and monitor what changes.","assurances":["No execution by default","Config-aware","No email to preview"],"capabilities":["Approval records","Config fingerprints","Drift evidence","Trust card gallery"]},"primer":{"title":"New to MCP?","paragraphs":["The Model Context Protocol (MCP) lets AI agents connect to external tools and data through MCP servers — local processes or remote services that expose actions like reading files, querying databases, or calling APIs.","That power is the risk. An MCP server can ship a tool whose description quietly instructs the agent to exfiltrate secrets, or change behavior after you approve it. MCP Risk reads the repo and config, produces a trust profile you can approve, and flags when the approved state drifts."]},"method":{"title":"A trust profile is not a scan. It is an approval record.","body":"The scanner only produces evidence. The product is the lifecycle around that evidence: who approved what, under which config, and what changed afterwards.","steps":[{"number":"01","title":"Evidence","body":"Extract declared tools, install commands, dependencies, env keys, permission surfaces, and risky code patterns."},{"number":"02","title":"Config","body":"Evaluate the actual launch context: command, args, tokens, filesystem scope, network exposure, and client."},{"number":"03","title":"Approval","body":"Bind decisions to repo version, config hash, policy version, analyzer version, reviewer, and environment."},{"number":"04","title":"Drift","body":"Trigger re-review when tools, descriptions, dependencies, env vars, or install commands change materially."}]},"reviewFlow":{"title":"Every MCP approval should leave evidence behind.","body":"A calm chain from tool request, to trust profile, to approval, to drift.","exampleSession":[{"kind":"cmd","text":"$ mcp-risk profile github.com/example/mcp-server"},{"kind":"out","text":"subject: github.com/example/mcp-server"},{"kind":"out","text":"config: 9f1c…42ab"},{"kind":"out","text":"verdict: approve_with_conditions"},{"kind":"cmd","text":"$ mcp-risk diff approved latest"},{"kind":"warn","text":"change: env_key_added GITHUB_TOKEN"},{"kind":"warn","text":"change: tool_added run_shell"},{"kind":"bad","text":"result: re-review required"}],"driftDiff":{"caption":"Approved profile vs. the live server, three weeks later.","verdict":"Approval lapsed — re-review required before this server runs again.","lines":[{"sign":" ","text":"subject: github.com/example/mcp-server"},{"sign":" ","text":"config: 9f1c…42ab"},{"sign":"+","text":"env_key_added: GITHUB_TOKEN"},{"sign":"+","text":"tool_added: run_shell"},{"sign":"-","text":"verdict: approve"},{"sign":"+","text":"verdict: re-review required"}]}},"library":[{"type":"Guide","title":"MCP server security checklist","summary":"Practical review criteria for MCP repos and configs.","url":"/library#mcp-server-security-checklist"},{"type":"Playbook","title":"Approval workflow for teams","summary":"How to record, review, and re-approve MCP usage.","url":"/library#approval-workflow-for-teams"},{"type":"Notes","title":"Tool poisoning and drift","summary":"Why descriptions and schemas need ongoing monitoring.","url":"/library#tool-poisoning-and-drift"},{"type":"Example","title":"Claude Desktop config review","summary":"Common risks in local MCP configuration files.","url":"/library#claude-desktop-config-review"},{"type":"Reference","title":"Reading a trust profile","summary":"What each verdict, card, and drift signal means.","url":"/library#reading-a-trust-profile"},{"type":"Template","title":"Policy pack starter","summary":"Baseline rules for local dev and company laptops.","url":"/library#policy-pack-starter"}],"callToAction":{"title":"Generate your first MCP trust profile.","body":"Submit a repo or config. See the verdict and summary instantly — add your email to unlock the full evidence and downloadable card."},"api":{"submit":{"method":"POST","path":"/api/submit","body":{"repoOrConfig":"<github url or mcp.json contents>"},"returns":"Trust profile preview: verdict, riskLevel, summary, publicSlug, status."},"profileStatus":{"method":"GET","path":"/api/profile/{publicSlug}/status","returns":"Current scan status and profile for a submitted subject."},"feed":{"method":"GET","path":"/api/feed","query":{"limit":"1-100, default 25","cursor":"opaque, from nextCursor"},"conditional":"Send If-None-Match; an unchanged poll returns 304 with no body.","returns":"Published advisories, newest first. Withdrawn advisories remain with withdrawn: true."},"feedAtom":{"method":"GET","path":"/api/feed.atom","returns":"The same advisories as Atom."},"advisory":{"method":"GET","path":"/api/advisory/{advisoryCode}","returns":"One advisory. Append .osv.json for an OSV-schema record."},"server":{"method":"GET","path":"/api/server/{publicSlug}","returns":"Reputation grade with its component arithmetic, plus the drift timeline."},"badge":{"method":"GET","path":"/api/server/{publicSlug}/badge.svg","returns":"Embeddable grade badge (SVG)."}},"crawler":{"policyUrl":"/crawler","userAgent":"MCPRiskBot/1.0 (+https://mcprisk.dev/crawler)","contact":"crawler@mcprisk.dev","sources":[{"name":"mcpservers.org","kind":"directory_site","host":"mcpservers.org","status":"active","reads":"robots.txt, the sitemap index and its shards, and the individual server pages the sitemap lists.","cadence":"At most once every 24 hours, at one request per second, and only for pages whose sitemap lastmod has moved since the previous visit."},{"name":"modelcontextprotocol-registry","kind":"registry_api","host":"registry.modelcontextprotocol.io","status":"planned","reads":"The public registry API's server listing endpoints.","cadence":"At most once every 6 hours."},{"name":"github-topic-mcp-server","kind":"github_search","host":"api.github.com","status":"planned","reads":"The authenticated GitHub search API for the `mcp-server` topic, within the documented rate limit.","cadence":"At most once every 24 hours."},{"name":"npm-keyword-mcp","kind":"package_registry","host":"registry.npmjs.org","status":"planned","reads":"The public npm search API for the `mcp` keyword, and package metadata for the results.","cadence":"At most once every 24 hours."}],"rules":[{"heading":"What we take","items":["From a directory page, only the upstream identifiers it names: the repository URL, the package reference, the endpoint URL. Nothing else.","We do not store or republish a directory's descriptions, categories, curation, rankings, install counts, or logos. Those are its work product.","Everything we publish about a server — manifest, findings, grade, advisory text — is re-derived from the primary source the pointer names, not from the directory that pointed at it."]},{"heading":"How we behave","items":["robots.txt is re-fetched on every run and honoured. It is never cached past the run, so an exclusion you add takes effect on our next visit without anyone emailing us.","robots.txt is read from every host we request, not once from whichever site published the sitemap. If your sitemap lists pages on a CDN or a subdomain, that host's own rules are the ones we obey.","We read sitemaps only. API paths are refused by a hard-coded deny-list in the crawler regardless of what robots.txt permits, so a robots.txt that accidentally opens one does not tempt us.","One request per second per host by default, enforced in code rather than stated as an intention, with a per-run page cap.","Pages whose sitemap lastmod has not moved are not re-fetched at all. A directory that stops changing stops being crawled.","When the per-run cap is reached, the pages we did not get to are the ones we start with next time. The budget rotates rather than repeatedly re-fetching whatever your sitemap happens to list first.","We never authenticate, never submit forms, never execute a listed server, and never call an MCP server's tools."]},{"heading":"What we never do","items":["We do not crawl private or access-controlled pages, and we do not attempt to work around a paywall, a login, or a rate limit.","We do not run any code from a scanned repository: no installs, no build scripts, no post-install hooks.","We do not resolve or fetch internal, loopback, or link-local addresses; every URL is checked before the request is made."]}],"optOut":"Two ways, both honoured. Add a Disallow for MCPRiskBot to your robots.txt and it takes effect on the next run with no further action from us. Or email crawler@mcprisk.dev and we will disable the source and confirm; no justification needed, and we do not ask you to reconsider."},"machineSurfaces":["/llms.txt","/api/site","/ai","/crawler"]}