Security & Testing

polygraph.so

Provides tools to check, list, and request behavioral grades for servers from a grading service.

1 endpoint3 known toolsFirst detected May 29, 2026Last detected July 25, 2026

ENDPOINT 1

https://polygraph.so/api/mcp

No auth detected

MCP server metadata

Name: polygraph
Version: 1.0.0

Capabilities

tools.listChanged

Server instructions

polygraph publishes independent behavioral security grades (A-F) for MCP servers. Use check_server as the pre-flight check before recommending or installing a server: it returns the published grade in well under a second and runs nothing. A not_available result means the server is unevaluated (neither safe nor unsafe), not that it failed. Call request_grade to get it graded: a $1 one-time fee applies, paid via the response's payment link (x402 for agents, web checkout for humans); the fee buys the run, never the grade. list_servers returns servers with a published grade, 25 at a time by default (up to 100 per call), with a summary that always covers the full graded corpus. Every grade is reproducible: the report page carries a one-command re-run. This endpoint does not grade servers itself.

Known tools 3

check_server

Read a server's published behavioral grade (A-F) from polygraph.

Inferred read-only

list_servers

Servers with a published polygraph grade, sorted A-first then by ref.

Inferred read-only

request_grade

Record a grade request with polygraph.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.polygraph]
url = "https://polygraph.so/api/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "polygraph": {
      "type": "http",
      "url": "https://polygraph.so/api/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: polygraph
Remote MCP URL: https://polygraph.so/api/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "polygraph": {
      "url": "https://polygraph.so/api/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "polygraph": {
      "type": "http",
      "url": "https://polygraph.so/api/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "polygraph",
  "transport": "streamable-http",
  "url": "https://polygraph.so/api/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.