# MCP Risk

> Evidence-backed trust profiles for MCP repos and configs. Approve a known-good state and monitor what changes.

Approval has a shelf life. That power is the risk. An MCP server can ship a tool whose description quietly instructs the agent to exfiltrate secrets, or change behavior after you approve it. MCP Risk reads the repo and config, produces a trust profile you can approve, and flags when the approved state drifts.

## Method

- Evidence: Extract declared tools, install commands, dependencies, env keys, permission surfaces, and risky code patterns.
- Config: Evaluate the actual launch context: command, args, tokens, filesystem scope, network exposure, and client.
- Approval: Bind decisions to repo version, config hash, policy version, analyzer version, reviewer, and environment.
- Drift: Trigger re-review when tools, descriptions, dependencies, env vars, or install commands change materially.

## Pages

- [Home](/): Product overview and instant trust-profile generation.
- [AI view](/ai): Semantic, machine-first rendering of the site content.
- [Crawler policy](/crawler): Manual Go v2 source requests, the separate snapshot worker, and how to opt out.
- [Servers](/servers): Public reputation grades for MCP servers, worst first.
- [Server page](/server/{public_slug}): One server's grade, component breakdown, and capability-change history.
- [Advisory](/advisory/{advisory_code}): One advisory, citable by code (e.g. MCPR-2026-0001).

## Threat feed

- GET /api/feed returns published advisories, newest first, cursor-paginated. Send If-None-Match; an unchanged poll returns 304.
- GET /api/feed.atom is the same content as Atom.
- GET /api/advisory/{advisory_code} returns one advisory; append .osv.json for an OSV-schema record consumable by existing vulnerability tooling.
- GET /api/server/{public_slug} returns the reputation grade with the component arithmetic it was computed from, plus the drift timeline.
- GET /api/server/{public_slug}/badge.svg is an embeddable grade badge.
- Withdrawn advisories stay in the feed with a withdrawn flag rather than disappearing: a consumer who already ingested one has no other way to learn it was pulled.
- Advisories are never auto-published. A public label is deliberately softer than an internal classification until a human corroborates it.

## Crawler

- User-Agent: mcp-risk-crawler-worker/1
- Separate snapshot User-Agent: MCPRiskBot/1.0 (+https://mcprisk.dev/crawler); snapshot jobs may request MCP metadata methods, but never invoke tools.
- Contact: crawler@mcprisk.dev
- Status: manual Go v2 artifact runs only. A daily Official Registry schedule is defined but disabled; no crawler schedule is enabled. If enabled, each run reads at most 100 records from a stored cursor.
- Schedule (disabled): official-registry, daily, at most 100 records, 20 HTTP requests, 32 MiB and 3 minutes per run; artifacts kept privately for 90 days.
- Sources: official-registry (registry.modelcontextprotocol.io; manual-schedule-disabled), github-registry (api.mcp.github.com; manual), docker-catalog (desktop.docker.com; manual), mcpservers-org (mcpservers.org; manual-opt-in).
- Default selection: official-registry, github-registry, docker-catalog; at most 100 records per source.
- Limits: 50,000 records, 500 HTTP requests, 250 MiB downloaded and 15 minutes per run.
- mcpservers-org requires explicit acknowledgement; it fetches sitemap XML only, never listed pages or /api/.
- This crawler does not fetch robots.txt or enforce a per-host request rate, manually or on the schedule. To opt out, email crawler@mcprisk.dev.

## API

- POST /api/submit with JSON {"repoOrConfig": "<github url or mcp.json>"} returns a profileUrl plus the scan status overall and per MCP server. No authentication required.
- GET /api/profile/<publicSlug>/status returns the scan status and, per MCP server, its verdict, risk level, summary and profile.
- GET /api/site returns this site's full page content as structured JSON.

## Notes for agents

- Trust profiles are approval records: they bind a verdict to a repo version, config hash, and analyzer version, and flag drift afterwards.
- Scans read repos and configs; nothing is executed by default.
- Approve MCPs once. Know when they change.