Security & Testing

policylayer.com

Check, search, and audit MCP servers against a risk registry to enforce security policies.

1 endpoint5 known toolsFirst detected May 29, 2026Last detected July 25, 2026

ENDPOINT 1

https://api.policylayer.com/mcp

No auth detected

MCP server metadata

Name: policylayer-registry
Version: 1.0.0

Capabilities

tools

Server instructions

The PolicyLayer MCP registry: risk intelligence on ~32,000 published MCP servers, continuously crawled and classified. Call check_mcp_server before installing or allowing any MCP server; check_mcp_stack to check every server in a stack at once; check_tool before allowing a specific risky tool call. Lookups are free; the change feed (get_change_events) needs a Registry Licence key.

Known tools 5

check_mcp_server

Check an MCP server against the PolicyLayer registry BEFORE installing or allowing it.

Inferred read-only

check_mcp_stack

Check a whole MCP stack against the PolicyLayer registry in one call — up to 25 servers, each given as candidate identifiers (npm package name, registry slug, or remote URL) tried in order until one resolves.

Inferred read-only

search_registry

Search the PolicyLayer registry of published MCP servers by name, slug or package substring.

Inferred read-only

check_tool

One tool's full risk classification on a published MCP server: category, severity, risk analysis and evidence, OWASP classes, parameter schema and the recommended policy default.

Inferred read-only

get_change_events

The registry change feed: tool-surface drift, auth-posture flips, impostor flags, version bumps — every event the freshness watchers emit, id-cursored so a consumer resumes exactly where it stopped.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.policylayer-registry]
url = "https://api.policylayer.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "policylayer-registry": {
      "type": "http",
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: policylayer-registry
Remote MCP URL: https://api.policylayer.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "policylayer-registry": {
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "policylayer-registry": {
      "type": "http",
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "policylayer-registry",
  "transport": "streamable-http",
  "url": "https://api.policylayer.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.