com.policylayer由 policylayer.com 發布官方發布者v1.0.1更新於 Oct 24, 2026
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
發布方自己的服務：PolicyLayer
託管於 PolicyLayer 的服務，讓助理在安裝前查詢已發布的 MCP 伺服器，核對其身分、風險等級與每個工具的風險。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/com.policylayer%2Fregistry/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"registry": {
"type": "http",
"url": "https://api.policylayer.com/mcp"
}
}
}The MCP server that vets MCP servers.
Connect your agent to the PolicyLayer registry and it can ask one question before installing or allowing any MCP server: is this safe? The answer is the published registry record: verified identity with the evidence, an A to F risk grade, probed auth posture and every tool's risk classification.
https://api.policylayer.com/mcp (Streamable HTTP)Claude Code
Claude (desktop / web)
Settings → Connectors → Add custom connector → URL https://api.policylayer.com/mcp
Cursor / Windsurf / VS Code
Then tell your agent: "check any MCP server against PolicyLayer before installing it." Add it to your team's agent instructions and every install gets vetted.
Ask your agent "is the github MCP server safe to install?" and it calls:
and gets back the published record (trimmed):
get_change_events needs a Registry Licence key (plr_...), self-serve at policylayer.com/registry/pricing.
--header "Authorization: Bearer plr_..." to the command above"headers": { "Authorization": "Bearer plr_..." } inside the server entryEverything about a single server is free and complete: the full record, every tool, the whole classification. A Registry Licence adds breadth across the catalogue: the change feed above, plus bulk snapshots, keyset paging and webhooks on the /v1 API.
The connect kit for a hosted service. The server runs at api.policylayer.com; there is no code to run from here. server.json is the listing published to the official MCP Registry as com.policylayer/registry. The MIT licence covers the contents of this repository only; the hosted service and the registry data are licensed separately.
來源：README.md，提交 d95b8a6
Check an MCP server against the PolicyLayer registry BEFORE installing or allowing it. Accepts a registry slug, an npm package name (scoped or not), a remote server URL (https://…), or a server name. Returns the full published record: identity verification with its evidence, risk grade, auth posture, freshness, and the tool surface listed riskiest-first. A server the registry does not know is queued for scanning by this very call — check back shortly.
server必填Check a whole MCP stack against the PolicyLayer registry in one call — up to 25 servers, each given as candidate identifiers (npm package name, registry slug, or remote URL) tried in order until one resolves. Returns the published record for every hit — plus a deterministic verdict (attention signals and a suggested action) — and the lookup status for every miss; counts, grades and flagged tools come from the published records only. Costs one rate-limit unit per server.
servers必填Search the PolicyLayer registry of published MCP servers by name, slug or package substring. Returns candidate matches with risk grade, identity confidence (verified / unverified / mismatch — mismatch means it claims to be an official server with no verifiable link to the brand) and tool count — follow up with check_mcp_server on the match you meant.
limitquery必填One tool's full risk classification on a published MCP server: category, severity, risk analysis and evidence, OWASP classes, parameter schema and the recommended policy default. Use when deciding whether to allow a specific tool call, e.g. "should execute_sql on this server be permitted?"
tool必填server必填The registry change feed: tool-surface drift, auth-posture flips, impostor flags, version bumps — every event the freshness watchers emit, id-cursored so a consumer resumes exactly where it stopped. Requires a Registry Licence key (Authorization: Bearer plr_...); self-serve at https://policylayer.com/registry/pricing.
limitafter_idseverity已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
claude mcp add --transport http policylayer https://api.policylayer.com/mcp{ "mcpServers": { "policylayer": { "url": "https://api.policylayer.com/mcp"} } }{ "name": "check_mcp_server", "arguments": { "server": "github" } }{ "slug": "github", "riskGrade": "D", "identity": { "verification": "official", "confidence": "verified" }, "posture": { "auth": "gated", "rateLimited": false }, "toolCount": 86, "tools": [ { "name": "delete_file", "category": "Destructive", "severity": "High", "recommendedPolicy": { "action": "deny" } } ]}