MCP spec 2026-07-28 goes final: 10,000+ servers must migrate. Time left: Check your server now →
Agentjacking hijacks Claude Code, Cursor & Codex at 85% · 40% of MCP servers ship with no auth · June 2026

Know what's safe
to connect before you plug it in.

Your AI agents are reaching into tens of thousands of third-party tools and MCP servers, straight into your production data. Conformant is the independent trust registry that grades every one of them, cryptographically anchors the result, and re-verifies it weekly. SOC 2 for the things you let your AI touch.

conformant.io / scanEXAMPLE REPORT
AUTHENTICATION
FAIL
No auth on tool endpoints: open to the internet
TOOL POISONING
WARN
Injection surface in 2 tool descriptions
SCOPES
FAIL
Wildcard DB credentials granted
DESTRUCTIVE GUARDRAILS
WARN
delete_* tools lack confirmation
SPEC 2026-07-28
PASS
Stateless core, migration-ready
OVERALL GRADE
F
Do not connect to production data
Illustrative example, not a live scan.Paste a real URL above for an anchored, verifiable report
Built on open standards
Sigstore / Rekor transparency logMCP spec 2026-07-28NSA MCP guidance–alignedIETF Web Bot Auth–compatibleOAuth 2.1
0
internet-exposed MCP servers (~40% with zero authentication)
Adversa AI · Jun 4 2026
0
of enterprises reported an AI-agent-caused security incident in 2026
Kiteworks · Jun 2026
Jul 28
MCP spec final ships: 10,000+ servers must re-migrate
modelcontextprotocol.io
0
of orgs have completed an AI audit (95% have already deployed AI)
Veeam · Jun 2026
The surface moved

It's no longer just exposed servers. The tools themselves became the weapon.

The last few weeks moved the attack surface under the ecosystem's feet. The injection is now inside the tool responses your agent already trusts and inside the SDK every server is built on. Neither is caught by watching traffic after you connect. Both are the reason to grade a tool before you plug it in.

AGENTJACKING
85%
A single public Sentry key makes Claude Code, Cursor & Codex run attacker code: 2,388 orgs exposed Tenet Security · Jun 17 2026
SDK-LAYER RCE
12 CVEs
One command-injection root cause in the MCP SDK layer, inherited across the ecosystem, mostly unpatched OX Security · Apr 15 2026
WHY IT LANDS
0 alerts
Every step is authorized: EDR, WAF, IAM and firewalls register nothing. The check has to happen before the connection

Straight talk: a Conformant grade measures a server's posture: auth, scopes, transport, and the injection surface in its own tool descriptions (CFM-03). It does not sanitize the live content an authorized tool relays back; poisoned responsesare a frontier the whole ecosystem is still hardening, and we won't claim a grade stops them. What a grade gives you is the input procurement actually needs: a documented, anchored read on the tool before it reaches your data, plus a registry and a minimum-grade policy to decide which tools are even eligible to touch your agents.

The attestation registry

Not a new product. The piece that was always missing.

The web got a certificate authority the moment enough traffic depended on trust nobody was verifying. AI agents are at that moment now: thousands of MCP tools reaching into production data, and no standing, public, tamper-evident record of which are safe to connect. Conformant is that record. A grade you read before you connect; an attestation the operator signs and anchors; a class like OX Security's MCP command injection mapped, not marketed around.

MAPPED, NOT IGNORED
12 CVEs
OX Security's MCP command-injection class (Apr 15 2026) surfaces on every scan as the CFM-09 advisory: the sink surface, remotely observed Read the advisory →
ATTESTED, NOT ASSERTED
Rekor
What a remote probe can't test, the operator attests: a signed declaration anchored to a public transparency log, so grade #2 is a re-verification, not a trust-me
INEVITABLE, NOT NEW
CA-grade
The same shape as a certificate authority: neutral, third-party, standing infrastructure the ecosystem checks against before it connects

See the MCP command-injection advisory →

Watch the 90-second explainer

One prompt away from your database.

The agent gold rush was built on unlocked doors. Here's the whole problem, and the fix, in 90 seconds.

Conformant: don't connect what you can't verify.90s · 1080p · rendered programmatically in Remotion
The platform

One credential. Five surfaces.

Everyone else governs agents at runtime, after you've already decided to connect. Conformant lives where the decision actually happens: procurement.

Grade any MCP server in seconds.

Paste a URL or upload a manifest. The Conformant Battery probes the live endpoint across 8 dimensions and returns a weighted A–F grade with line-item findings.

  • Authentication & OAuth-flow correctness
  • Tool-poisoning & prompt-injection surface
  • Scope minimization & secret exposure
  • Destructive-tool guardrails
  • 2026-07-28 statelessness conformance
$ conformant scan https://mcp.vendor.com/sse

▸ CFM-01 AUTH ............ FAIL: no auth on /sse
▸ CFM-02 OAUTH ........... WARN: redirect_uri unvalidated
▸ CFM-03 POISON .......... WARN: 2 injectable descriptions
▸ CFM-04 SCOPES .......... FAIL: wildcard db creds
▸ CFM-05 SECRETS ......... PASS
▸ CFM-06 DESTRUCT ........ WARN: delete_* unconfirmed
▸ CFM-07 STATELESS ....... PASS: 2026-07-28 ready
▸ CFM-08 TRANSPORT ....... PASS

GRADE: F. Do not connect to production data
report anchored → rekor logIndex 1548217734

A grade nobody can fake. Including us.

Every report is hashed and written to the Sigstore/Rekor public transparency log. The grade can't be back-dated, edited, or quietly deleted; anyone can verify it independently, forever.

  • SHA-256 report digest, anchored at issue time
  • Public verify link on every report and badge
  • Grade history is append-only: trust that compounds
  • The artifact auditors and insurers can actually rely on
// every grade is a transparency-log entry
{
  "server": "mcp.vendor.com",
  "grade": "A",
  "battery": "CFM-8 v1",
  "digest": "sha256:9f3a…c021",
  "rekor": {
    "logIndex": 1551442087,
    "integratedTime": 1781136000
  },
  "reVerified": "weekly"
}
// verify: rekor-cli get --log-index 1551442087

The place security teams check first.

Every scanned server, graded and last-verified, in one public index. Before your team connects anything, the question becomes one lookup: is it on Conformant, and what's the grade?

  • Search by server, vendor, category, or capability
  • Grade + last-verified timestamp on every row
  • Named-vendor grades published under coordinated disclosure
  • Watchlists: get alerted when a tool you use drops a grade
GET /api/v1/registry?q=postgres&min_grade=B

200 OK
{
  "results": [
    { "server": "pg-mcp.vendor-a.dev", "grade": "A", "verified": "2026-06-09" },
    { "server": "sql-bridge.vendor-b.io", "grade": "B", "verified": "2026-06-08" }
  ],
  "excluded_below_grade": 214
}

The badge that ends the security-review stall.

Pass the battery, earn the embeddable Conformant Verified badge, re-verified weekly and linked to your live anchored report. Attach it to the questionnaire and move to commercials.

  • Live status: buyers see a current grade, not last quarter's stamp
  • One-line embed for your site, docs, and listing pages
  • Every badge links to the public Rekor-anchored report
  • Auto-revokes if your weekly re-verification fails
<!-- one-line embed -->
<script src="https://conformant.io/badge.js"
  data-server="mcp.vendor.com"></script>

renders →

┌──────────────────────────────┐
◆ CONFORMANT VERIFIED       │
│  Grade A · re-verified 6d ago
│  view anchored report ↗     │
└──────────────────────────────┘

Fleet-wide policy for everything your agents touch.

Conformant Control inventories every MCP server connected across your org (including private internal ones), enforces a minimum grade, and alerts the moment anything drops.

  • Private attestation for internal servers (never published)
  • Policy: "block connections below Grade B," enforced
  • Grade-drop alerts to Slack, Teams, or your SIEM
  • Board-ready agent-supply-chain posture report
# conformant-policy.yaml
org: acme-corp
policy:
  minimum_grade: B
  block_unregistered: true
  re_verify: weekly
alerts:
  - slack://sec-ops
  - siem://splunk-hec

✔ 47 servers in policy · 2 blocked · 1 grade-drop alert
How it works

Scan. Anchor. Display.

01 · SCAN

Paste a URL

The battery probes the live endpoint across all 8 dimensions and returns a weighted A–F grade with line-item findings, in seconds.

02 · ANCHOR

Tamper-evident proof

Every report is hashed into the Sigstore/Rekor public transparency log. The grade can't be faked, back-dated, or quietly edited.

03 · DISPLAY

The badge that clears you

Pass, and you earn the embeddable Conformant Verified badge (re-verified weekly) that ends the "is it safe?" stall in enterprise deals.

Who it's for

Three sides of the same trust problem.

Tool vendors

Stop losing deals to the questionnaire.

Your product is fine; your proof is missing. Get the third-party, cryptographically anchored credential that moves enterprise security review from weeks of email to one link.

Get Cleared-to-Connect →
Enterprise security

Vet every tool before agents touch it.

65% of firms already ate an agent-caused incident. Inventory what's connected, enforce a minimum grade, and get alerted the moment anything drops, including private internal servers.

See Conformant Control →
Insurers & auditors

Underwrite agent risk on evidence.

Append-only, anchored grade history across the agent-tool supply chain. The dataset that turns "AI risk" from a guess into a priced, auditable exposure.

Talk data licensing →
Why nothing else covers this

Adjacent isn't the same as solved.

Runtime gateways act after you connect. Researchers publish one-off findings. Identity standards verify the agent, not the tool. The pre-connect credential is the empty seat. Conformant sits in it.

CapabilityConformant
no gaps below
Runtime gatewaysSecurity researchAgent identity standards
Verdict before you connectAfter connectionOne-off postsNo pre-connect signal
Independent third partyPlatform-ownedConsortium specs
Standing, re-verified credentialweeklyNo standing credentialNo standing credentialNo standing credential
Cryptographically anchored gradesRekorNot anchoredNot anchoredNot anchored
Portable proof vendors can show buyersbadgeNot portableNot portableNot portable
Tests live MCP-protocol behavior8 checksTraffic proxyAd hocSigns requests
6/6 Conformant0/6 Runtime gateways1/6 Security research0/6 Agent identity standards
The registry

The registry is live. Every grade is anchored.

We grade the MCP servers enterprises connect and anchor every report to the Sigstore/Rekor transparency log. The marquee names pass. The danger is the unverified long tail.

SCANNED & ANCHORED
39
live servers, each report on the Rekor transparency log
OFFICIAL SERVERS
A–B
every marquee MCP server we have graded passes
THE LONG TAIL
40%
of internet-exposed MCP servers have no auth (Adversa, Jun 4 2026)
MIGRATION DEADLINE
Jul 28
10,000+ servers must re-ship for the final spec
ServerCategoryLast verifiedGrade
mcp.linear.app/mcpDev tools2026-06-12A
mcp.notion.com/mcpProductivity2026-06-12A
mcp.stripe.comPayments2026-06-12A
api.dashboard.plaid.com/mcpFintech2026-06-12B
[held: coordinated disclosure]Telephony2026-06-12F

Live registry sample (39 servers and growing). Passing public servers are listed by name; servers that fail stay anonymous under a coordinated-disclosure policy until the vendor is notified and given a remediation window.

Browse the live registry →

For tool vendors

Stop losing enterprise deals to the security questionnaire.

Be the tool buyers are allowedto plug in. Outcome-priced: you're buying enterprise-ready status, not a scanner subscription.

THE OFFER

Cleared-to-Connect

Verified in 7 days

Submit your server, pass the battery, earn the anchored badge in a week, or it's free until you are.

Free entry: the Risk Report

Scan any public server free and get a graded, anchored, shareable report. Real value before you pay a cent.

Risk reversal with teeth

Incident-response coverage on Growth and above: if a vulnerability class we graded as cleared is exploited during your coverage period, we cover documented response costs. Terms in the coverage agreement.

Continuous re-verification

Your grade re-runs weekly. Buyers always see a live status, not a stale stamp from last quarter.

The guarantee, with teeth:attach your Conformant report to your next enterprise security review. Don't clear it on the first pass and we refund every dollar and send you $1,000 for wasting your time.
Pricing

Priced against the deal it unlocks.

Indie
For solo builders shipping their first server
$99/mo
  • 1 server certified
  • Anchored A–F report
  • Verified badge
  • Weekly re-verification
  • Public registry listing
Start free scan
Most popular
Growth
For vendors selling into enterprises
$499/mo
  • Up to 5 servers
  • Everything in Indie
  • 7-day Cleared-to-Connect SLA
  • Incident-response coverage (terms in the coverage agreement)
  • Security-review report pack
  • Priority remediation guidance
Get Cleared-to-Connect
Enterprise
For security teams governing a fleet
$2,000/mo
  • Unlimited servers
  • Private internal-server attestation
  • Conformant Control dashboard
  • Grade-drop alerting + policy enforcement
  • Verification API (x402-payable)
  • SIEM / Slack / Teams integrations
Talk to us
FAQ

The questions security teams actually ask.

Eight documented checks (CFM-01 through CFM-08): authentication, OAuth-flow correctness, tool-poisoning surface, scope minimization, secret exposure, destructive-tool guardrails, 2026-07-28 spec conformance, and transport security. Each is weighted into the overall A–F grade, and every finding ships as a line item in the report. A ninth advisory line (CFM-09) maps every scan to the MCP command-injection class without affecting the grade.

Gateways proxy traffic after you've already decided to connect a tool. Conformant is the decision input: an independent, anchored grade you read at procurement time. They're complementary: many customers enforce a Grade B minimum in Conformant Control and route approved tools through their gateway.

No. Every report is hashed into the Sigstore/Rekor public transparency log at issue time. Grades are append-only: a vendor can improve and re-scan, but the history stays verifiable. Badges auto-revoke if weekly re-verification fails.

Not on its own, and we won't pretend otherwise. Agentjacking hijacks a Grade-A server (Sentry's own MCP) by poisoning the error content it relays, not by breaking the server's security posture. A Conformant grade measures posture: auth, scopes, transport, and the injection surface in a tool's own descriptions (CFM-03). Sanitizing the live third-party content an authorized tool passes back is a separate, ecosystem-wide problem still being solved. What the grade gives you is the pre-connect read procurement needs, plus a registry and a minimum-grade connection policy to control which tools are even eligible to touch your agents in the first place.

The MCP 2026-07-28 specification goes final: stateless core, MCP Apps, formal deprecation policy. Every stateful server must migrate. CFM-07 tests exactly this: scan now and you know precisely what breaks before your users find out.

Not by name. We operate a coordinated-disclosure policy: failing servers appear anonymously in aggregate statistics, the vendor is notified privately, and a remediation window applies before any named publication. Consented and already-publicly-disclosed servers are listed by name.

Yes. Conformant Control runs the same battery against private servers and produces anchored attestations that are never published. You get the proof for auditors without the exposure.

Yes, on Growth and above: if a vulnerability class we explicitly graded as cleared is exploited on your covered server during the coverage period, we cover your documented incident-response costs. Limits and terms are set in the coverage agreement; it's a commitment we price off a tested battery, not a gimmick.

Conformant is built in Houston, TX by Shayne Beavan on the same cryptographic evidence rails as VERDICT (AI action evidence) and COSIGN (action authorization). One trust layer: prove what's safe, prove what happened.

Part of a trust layer

One spine: prove what's safe, prove what happened.

Conformant → before

Certifies whether a tool is safe to connect. The pre-flight credential, consumed at procurement.

VERDICT → after

Produces tamper-evident evidence of what an agent actually did. The post-incident record, for liability.

COSIGN → at the moment

Authorizes high-value actions, deepfake-resistant. Its policy can require Conformant-Verified tools.

00
days
00
hours
00
min
00
sec

Don't connect what you can't verify.

Scan your first server free. Get the anchored grade. Know where you stand before July 28.

Run a free scan →Get Conformant-Verified