Registry MCP server
{
"mcpServers": {
"policylayer-registry": {
"type": "http",
"url": "https://api.policylayer.com/mcp"
}
}
}{
"mcpServers": {
"policylayer-registry": {
"type": "http",
"url": "https://api.policylayer.com/mcp"
}
}
}{
"mcpServers": {
"policylayer-registry": {
"type": "http",
"url": "https://api.policylayer.com/mcp"
}
}
}{
"servers": {
"policylayer-registry": {
"type": "http",
"url": "https://api.policylayer.com/mcp"
}
}
}{
"mcpServers": {
"policylayer-registry": {
"type": "http",
"url": "https://api.policylayer.com/mcp"
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsonversion 1.0.1
What it does
PolicyLayer Registry is an MCP server that lets you check the safety and risk profile of other MCP servers before installing them. It provides verified identity information, risk grades (A to F), authentication posture analysis, and per-tool risk classifications for over 32,500 published servers and 515,000+ tools.
- Check if an MCP server is safe to install by retrieving its identity verification, risk grade, and tool classifications before adding it to your environment.
- Search the registry to find verified MCP servers by name or package and compare their risk grades to select safer alternatives.
- Evaluate specific tools within an MCP server to understand their risk category, severity level, and recommended security policies before enabling them.
Tools this server exposes
| Tool | Does |
|---|---|
| check_mcp_server | Returns the full published record for an MCP server including identity verification, risk grade, authentication posture, and all tools ranked by risk severity. |
| search_registry | Finds published MCP servers matching a name, slug, or package substring and returns their grade and verification status. |
| check_tool | Returns the full risk classification for a specific tool including risk analysis, OWASP categories, parameters, and recommended policy defaults. |
| get_change_events | Provides an ordered change feed of drift, posture changes, and impostor flags across servers (requires a Registry Licence key). |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.