Security & Testing

policylayer.com

Check, search, and audit MCP servers against a risk registry to enforce security policies.

2 endpoints5 known toolsFirst detected May 29, 2026Last detected September 6, 2026

ENDPOINT 1

https://api.policylayer.com/mcp

No auth detected

MCP server metadata

Name: policylayer-registry
Version: 1.0.0

Capabilities

tools

Server instructions

The PolicyLayer MCP registry: risk intelligence on ~32,000 published MCP servers, continuously crawled and classified. Call check_mcp_server before installing or allowing any MCP server; check_mcp_stack to check every server in a stack at once; check_tool before allowing a specific risky tool call. Lookups are free; the change feed (get_change_events) needs a Registry Licence key.

Known tools 5

check_mcp_server

Check an MCP server against the PolicyLayer registry BEFORE installing or allowing it.

Inferred read-only

check_mcp_stack

Check a whole MCP stack against the PolicyLayer registry in one call — up to 25 servers, each given as candidate identifiers (npm package name, registry slug, or remote URL) tried in order until one resolves.

Inferred read-only

search_registry

Search the PolicyLayer registry of published MCP servers by name, slug or package substring.

Inferred read-only

check_tool

One tool's full risk classification on a published MCP server: category, severity, risk analysis and evidence, OWASP classes, parameter schema and the recommended policy default.

Inferred read-only

get_change_events

The registry change feed: tool-surface drift, auth-posture flips, impostor flags, version bumps — every event the freshness watchers emit, id-cursored so a consumer resumes exactly where it stopped.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.policylayer-registry]
url = "https://api.policylayer.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "policylayer-registry": {
      "type": "http",
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: policylayer-registry
Remote MCP URL: https://api.policylayer.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "policylayer-registry": {
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "policylayer-registry": {
      "type": "http",
      "url": "https://api.policylayer.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "policylayer-registry",
  "transport": "streamable-http",
  "url": "https://api.policylayer.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

ENDPOINT 2

https://mcp.policylayer.com/mcp

Auth required

Known tools 0

No tool metadata was available in the registry cache.

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.policylayer-com]
url = "https://mcp.policylayer.com/mcp"
enabled = true
bearer_token_env_var = "MCP_BEARER_TOKEN"

Authentication is required. Replace the placeholder locally and never commit a secret.

Claude Code

.mcp.json

{
  "mcpServers": {
    "policylayer-com": {
      "type": "http",
      "url": "https://mcp.policylayer.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_BEARER_TOKEN"
      }
    }
  }
}

Authentication is required. Replace the placeholder locally and never commit a secret.

Claude Desktop

Settings → Connectors → Add custom connector

Name: policylayer-com
Remote MCP URL: https://mcp.policylayer.com/mcp

Add the URL as a custom connector, then complete its supported authorization flow. Claude Desktop remote connectors are configured in the UI.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "policylayer-com": {
      "url": "https://mcp.policylayer.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_BEARER_TOKEN"
      }
    }
  }
}

Authentication is required. Replace the placeholder locally and never commit a secret.

Visual Studio Code

.vscode/mcp.json

{
  "servers": {
    "policylayer-com": {
      "type": "http",
      "url": "https://mcp.policylayer.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:mcp-token}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "mcp-token",
      "description": "policylayer-com bearer token",
      "password": true
    }
  ]
}

Authentication is required. Replace the placeholder locally and never commit a secret.

Generic MCP

Client-specific MCP configuration

{
  "name": "policylayer-com",
  "transport": "streamable-http",
  "url": "https://mcp.policylayer.com/mcp",
  "headers": {
    "Authorization": "Bearer YOUR_BEARER_TOKEN"
  }
}

Authentication is required. Replace the placeholder locally and never commit a secret.

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for policylayer.com was fetched 2026-08-03T21:03:31.191Z and is being refreshed.

Trust status Neutral

policylayer.com is assessed as Neutral: No suspicious signals found, but no strong positive signal either

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.