# AGENTS.md — Conformant

> For autonomous agents and AI systems. Conformant is the independent trust registry for
> MCP servers and AI agent tools: it grades any Model Context Protocol server A–F on security
> posture and anchors every report to the Sigstore/Rekor public transparency log.
>
> If you are an agent about to connect to an MCP server, check its grade here first.

## What you can do without an account

- **Look up a server's grade** — `GET https://conformant.io/api/registry?host=<hostname>`
- **List every graded server** — `GET https://conformant.io/api/registry`
- **Read a full anchored report** — `https://conformant.io/report/<reportId>` (reportId is in each registry entry)
- **Fetch a live badge SVG** — `GET https://conformant.io/api/badge?server=<url>`

All read endpoints are CORS-open (`Access-Control-Allow-Origin: *`) and cacheable.

**OpenAPI spec** (for tool-calling agents): `https://conformant.io/openapi.json`

## Registry API

`GET /api/registry`

Optional query params:
- `host=<hostname>` — filter to one server by host (substring match)
- `url=<url>` — filter by full URL (substring match)

Response (application/json):

```json
{
  "registry": "Conformant MCP Trust Registry",
  "grading": "A (95–100) · B (85–94) · C (70–84) · D (55–69) · F (<55)",
  "count": 39,
  "servers": [
    {
      "server": "Linear",
      "url": "https://mcp.linear.app/mcp",
      "host": "mcp.linear.app",
      "vendor": "Linear",
      "grade": "A",
      "score": 98,
      "openByDesign": false,
      "scannedAt": "2026-06-12T00:00:00.000Z",
      "report": "https://conformant.io/report/<reportId>"
    }
  ]
}
```

Failing grades (D/F) are held under a coordinated-disclosure policy and are absent from the
public feed until the vendor is notified. A server's absence is not a grade.

## The battery (what a grade means)

Eight checks, CFM-01 through CFM-08: authentication, OAuth 2.1 correctness, tool-poisoning
surface (injection patterns in tool descriptions), scope minimization, secret exposure,
destructive-tool guardrails, MCP 2026-07-28 spec conformance, and transport (TLS). Each is
weighted into the overall A–F grade. The scanner performs only the standard MCP client
handshake (initialize, notifications/initialized, tools/list) and never invokes a tool.

## Advisories

- **MCP STDIO command injection** — `https://conformant.io/advisory/mcp-command-injection`. OX Security's
  disclosure (2026-04-15): four exploit families, 12 CVEs, named affected products. Every scan carries a
  **CFM-09** advisory line reporting the remotely-observable command-execution sink surface; the local
  STDIO config-injection families are operator-attested, not remotely tested.

## Honest scope

A Conformant grade measures a server's posture before connection. It does not sanitize the
live content an authorized tool relays back — response-content injection (e.g. Agentjacking,
Tenet Security, Jun 17 2026) is an ecosystem-wide frontier. Use the grade as a pre-connect
input and enforce a minimum-grade connection policy; do not treat it as a guarantee that a
tool cannot be abused at runtime.

## Related

- Human docs / methodology: https://conformant.io/llms.txt
- Coordinated disclosure policy: https://conformant.io/disclosure
- Pricing (machine-readable): https://conformant.io/pricing.md

Last updated: 2026-07-04.