INDIVIDUAL MCP TOOL

check_mcp_server

Check an MCP server against the PolicyLayer registry BEFORE installing or allowing it.

policylayer.comnone authenticationAvailability not checked

Input schema

{}

Inferred read-only · medium confidence · heuristic, not a guarantee.

No write-capable action terms were found; this is not proof that invocation has no side effects.

CONNECT WITH APPROVAL

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.policylayer-registry]
url = "https://api.policylayer.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "policylayer-registry": {
      "type": "http",
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: policylayer-registry
Remote MCP URL: https://api.policylayer.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "policylayer-registry": {
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "policylayer-registry": {
      "type": "http",
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "policylayer-registry",
  "transport": "streamable-http",
  "url": "https://api.policylayer.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

check_mcp_stack — Check a whole MCP stack against the PolicyLayer registry in one call — up to 25 servers, each given as candidate identifiers (npm package name, registry slug, or remote URL) tried in order until one resolves.
search_registry — Search the PolicyLayer registry of published MCP servers by name, slug or package substring.
check_tool — One tool's full risk classification on a published MCP server: category, severity, risk analysis and evidence, OWASP classes, parameter schema and the recommended policy default.
get_change_events — The registry change feed: tool-surface drift, auth-posture flips, impostor flags, version bumps — every event the freshness watchers emit, id-cursored so a consumer resumes exactly where it stopped.