# MCP Risk

> Evidence-backed trust profiles for MCP repos and configs. Approve a known-good state and monitor what changes.

Know what your agents can run before they run it. That power is the risk. An MCP server can ship a tool whose description quietly instructs the agent to exfiltrate secrets, or change behavior after you approve it. MCP Risk reads the repo and config, produces a trust profile you can approve, and flags when the approved state drifts.

## Method

- Evidence: Extract declared tools, install commands, dependencies, env keys, permission surfaces, and risky code patterns.
- Config: Evaluate the actual launch context: command, args, tokens, filesystem scope, network exposure, and client.
- Approval: Bind decisions to repo version, config hash, policy version, analyzer version, reviewer, and environment.
- Drift: Trigger re-review when tools, descriptions, dependencies, env vars, or install commands change materially.

## Pages

- [Home](/): Product overview and instant trust-profile generation.
- [Library](/library): Build a safer MCP stack. Guides, playbooks, and references on MCP security.
- [AI view](/ai): Semantic, machine-first rendering of the site content.
- [Crawler policy](/crawler): What MCPRiskBot fetches, from which sources, and how to opt out.
- [Servers](/servers): Public reputation grades for MCP servers, worst first.
- [Server page](/server/{public_slug}): One server's grade, component breakdown, and capability-change history.
- [Advisory](/advisory/{advisory_code}): One advisory, citable by code (e.g. MCPR-2026-0001).

## Threat feed

- GET /api/feed returns published advisories, newest first, cursor-paginated. Send If-None-Match; an unchanged poll returns 304.
- GET /api/feed.atom is the same content as Atom.
- GET /api/advisory/{advisory_code} returns one advisory; append .osv.json for an OSV-schema record consumable by existing vulnerability tooling.
- GET /api/server/{public_slug} returns the reputation grade with the component arithmetic it was computed from, plus the drift timeline.
- GET /api/server/{public_slug}/badge.svg is an embeddable grade badge.
- Withdrawn advisories stay in the feed with a withdrawn flag rather than disappearing: a consumer who already ingested one has no other way to learn it was pulled.
- Advisories are never auto-published. A public label is deliberately softer than an internal classification until a human corroborates it.

## Crawler

- User-Agent: MCPRiskBot/1.0 (+https://mcprisk.dev/crawler)
- Contact: crawler@mcprisk.dev
- Sources read: mcpservers.org
- robots.txt is re-fetched every run and honoured; sitemaps only; API paths are refused by a hard-coded deny-list.
- Only upstream identifiers (repository, package, endpoint) are taken from a listing page. Descriptions, curation, and rankings are never stored or republished.
- Opt out by adding a Disallow for MCPRiskBot to robots.txt, or by emailing crawler@mcprisk.dev.

## API

- POST /api/submit with JSON {"repoOrConfig": "<github url or mcp.json>"} returns a trust profile preview (verdict, risk level, summary, public slug). No authentication required.
- GET /api/profile/<publicSlug>/status returns the current scan status and profile for a submitted subject.
- GET /api/site returns this site's full page content as structured JSON.

## Library topics

- [MCP server security checklist](/library#mcp-server-security-checklist): Practical review criteria for MCP repos and configs.
- [Approval workflow for teams](/library#approval-workflow-for-teams): How to record, review, and re-approve MCP usage.
- [Tool poisoning and drift](/library#tool-poisoning-and-drift): Why descriptions and schemas need ongoing monitoring.
- [Claude Desktop config review](/library#claude-desktop-config-review): Common risks in local MCP configuration files.
- [Reading a trust profile](/library#reading-a-trust-profile): What each verdict, card, and drift signal means.
- [Policy pack starter](/library#policy-pack-starter): Baseline rules for local dev and company laptops.

## Notes for agents

- Trust profiles are approval records: they bind a verdict to a repo version, config hash, and analyzer version, and flag drift afterwards.
- Scans read repos and configs; nothing is executed by default.
- Approve MCPs once. Know when they change.