English Français العربية

com.policylayer/registry

Official registry Other

The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http registry 'https://api.policylayer.com/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "registry": {
            "type": "http",
            "url": "https://api.policylayer.com/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. PolicyLayer Registry MCP Server
  2. Connect
  3. Tools
  4. Example
  5. Things to ask your agent
  6. Adding a licence key
  7. Free and licensed
  8. What this repository is

PolicyLayer Registry MCP Server

The MCP server that vets MCP servers.

Connect your agent to the PolicyLayer registry and it can ask one question before installing or allowing any MCP server: is this safe? The answer is the published registry record: verified identity with the evidence, an A to F risk grade, probed auth posture and every tool's risk classification.

  • Endpoint: https://api.policylayer.com/mcp (Streamable HTTP)
  • Free single-server lookups, no key needed
  • 32,500+ published servers and 515,000+ classified tools, kept current by continuous scanning
  • Docs: policylayer.com/registry/mcp

Connect

Claude Code

claude mcp add --transport http policylayer https://api.policylayer.com/mcp

Claude (desktop / web)

Settings → Connectors → Add custom connector → URL https://api.policylayer.com/mcp

Cursor / Windsurf / VS Code

{ "mcpServers": {
  "policylayer": {
    "url": "https://api.policylayer.com/mcp"
} } }

Then tell your agent: "check any MCP server against PolicyLayer before installing it." Add it to your team's agent instructions and every install gets vetted.

Tools

ToolWhat it returnsTier
check_mcp_serverFull record for one server: identity + evidence, risk grade, posture, tools riskiest-first. Unknown servers are queued for scanning by the lookup itself.Free
search_registryPublished servers matching a name, slug or package substring, with grade and verification on every match.Free
check_toolOne tool's full classification: risk analysis and evidence, OWASP classes, parameters, recommended policy default.Free
get_change_eventsThe ordered change feed: drift, posture flips, impostor flags. Cursor-based, with severity filters.Licence

Example

Ask your agent "is the github MCP server safe to install?" and it calls:

{ "name": "check_mcp_server", "arguments": { "server": "github" } }

and gets back the published record (trimmed):

{
  "slug": "github",
  "riskGrade": "D",
  "identity": { "verification": "official", "confidence": "verified" },
  "posture": { "auth": "gated", "rateLimited": false },
  "toolCount": 86,
  "tools": [
    { "name": "delete_file", "category": "Destructive", "severity": "High", "recommendedPolicy": { "action": "deny" } }
  ]
}

Things to ask your agent

  • "Is the github MCP server safe to install?"
  • "We're adding the notion and linear MCP servers this week. Vet both and summarise the risks."
  • "Which of the MCP servers in this project can delete data or move money?"
  • "Should I allow the execute_sql tool on the postgres server? What policy does PolicyLayer recommend?"
  • "Find a verified MCP server for Slack and show me its risk grade."
  • "Check every server in my mcpServers config against PolicyLayer and flag anything below grade C."
  • With a licence key: "What changed in the servers we depend on since yesterday? Any posture flips or impostor flags?"

Adding a licence key

get_change_events needs a Registry Licence key (plr_...), self-serve at policylayer.com/registry/pricing.

  • Claude Code: append --header "Authorization: Bearer plr_..." to the command above
  • Cursor / Windsurf / VS Code: add "headers": { "Authorization": "Bearer plr_..." } inside the server entry
  • Claude desktop/web connectors can't send headers; free lookups only

Free and licensed

Everything about a single server is free and complete: the full record, every tool, the whole classification. A Registry Licence adds breadth across the catalogue: the change feed above, plus bulk snapshots, keyset paging and webhooks on the /v1 API.

What this repository is

The connect kit for a hosted service. The server runs at api.policylayer.com; there is no code to run from here. server.json is the listing published to the official MCP Registry as com.policylayer/registry. The MIT licence covers the contents of this repository only; the hosted service and the registry data are licensed separately.

PolicyLayer · Registry lookup · API reference · Licensing

Frequently asked questions

What is com.policylayer/registry?

The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.

How do I install com.policylayer/registry?

It runs as a remote server. In Claude Code: claude mcp add --transport http registry 'https://api.policylayer.com/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does com.policylayer/registry need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is com.policylayer/registry open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains com.policylayer/registry?

It is published by PolicyLayer. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.