PolicyLayer Registry MCP Server

The MCP server that vets MCP servers.

Connect your agent to the PolicyLayer registry and it can ask one question before installing or allowing any MCP server: is this safe? The answer is the published registry record: verified identity with the evidence, an A to F risk grade, probed auth posture and every tool’s risk classification.

• Endpoint: https://api.policylayer.com/mcp (Streamable HTTP)
• Free single-server lookups, no key needed
• 32,500+ published servers and 515,000+ classified tools, kept current by continuous scanning
• Docs: policylayer.com/registry/mcp

Connect

Claude Code

claude mcp add --transport http policylayer https://api.policylayer.com/mcp

Claude (desktop / web)

Settings → Connectors → Add custom connector → URL https://api.policylayer.com/mcp

Cursor / Windsurf / VS Code

{ "mcpServers": {
  "policylayer": {
    "url": "https://api.policylayer.com/mcp"
} } }

Then tell your agent: “check any MCP server against PolicyLayer before installing it.” Add it to your team’s agent instructions and every install gets vetted.

Tools

Example

Ask your agent “is the github MCP server safe to install?” and it calls:

{ "name": "check_mcp_server", "arguments": { "server": "github" } }

and gets back the published record (trimmed):

{
  "slug": "github",
  "riskGrade": "D",
  "identity": { "verification": "official", "confidence": "verified" },
  "posture": { "auth": "gated", "rateLimited": false },
  "toolCount": 86,
  "tools": [
    { "name": "delete_file", "category": "Destructive", "severity": "High", "recommendedPolicy": { "action": "deny" } }
  ]
}

Things to ask your agent

• “Is the github MCP server safe to install?”
• “We’re adding the notion and linear MCP servers this week. Vet both and summarise the risks.”
• “Which of the MCP servers in this project can delete data or move money?”
• “Should I allow the execute_sql tool on the postgres server? What policy does PolicyLayer recommend?”
• “Find a verified MCP server for Slack and show me its risk grade.”
• “Check every server in my mcpServers config against PolicyLayer and flag anything below grade C.”