# Conformant — Full Context for AI Systems

> The independent trust registry and verified-badge program for AI agent tools (MCP servers and
> connectors). Scan any MCP server, get a cryptographically anchored A–F security grade, and check
> the registry before you connect. "SOC 2 for AI agent tools." Built in Houston, TX by Shayne Beavan.
> Canonical site: https://conformant.io · Last updated: 2026-07-04.

## What Conformant is

Conformant grades Model Context Protocol (MCP) servers — the third-party tools AI agents plug into —
across an 8-point security battery, assigns an A–F grade, and anchors every report to the
Sigstore/Rekor public transparency log so the grade is tamper-evident and independently
reproducible. Grades are re-verified weekly. A grade is an automated observation of a publicly
reachable endpoint at a timestamp, not a certification.

The problem it solves: every other product in AI-agent security governs agents AT RUNTIME — after
a tool is already connected. Gateways proxy traffic, researchers publish one-off CVEs, identity
standards verify the agent. None of them answer the question procurement actually asks: "is this
tool safe to connect to our data?" Conformant is that pre-connect input.

## The battery (CFM-01 through CFM-08)

- CFM-01 Authentication — does the endpoint gate access, or complete an anonymous session? (40% of
  internet-exposed MCP servers fail this — Adversa AI, Jun 4 2026)
- CFM-02 Authorization — OAuth 2.1 discovery (WWW-Authenticate + RFC 9728 protected-resource metadata)
- CFM-03 Tool poisoning — prompt-injection surface in tool descriptions and server instructions
- CFM-04 Scopes — least privilege; arbitrary-execution and admin-scope tools
- CFM-05 Secrets — credential patterns disclosed in tool metadata
- CFM-06 Destructive guardrails — destructive-class tools annotated so hosts can require confirmation
- CFM-07 Spec 2026-07-28 readiness — Streamable HTTP transport and statelessness posture
- CFM-08 Transport — TLS

Grade bands: A (95–100), B (85–94), C (70–84), D (55–69), F (<55). The scanner performs only the
standard MCP client handshake (initialize, notifications/initialized, tools/list) and never invokes
a tool.

## Key pages

- Scanner — https://conformant.io/scan — grade any MCP server free, in seconds, with an anchored report
- Trust Registry — https://conformant.io/registry — the public index of graded, Rekor-anchored servers
- Registry API (machine-readable) — https://conformant.io/api/registry — CORS-open JSON for agents
- Agent guide — https://conformant.io/AGENTS.md
- Pricing (machine-readable) — https://conformant.io/pricing.md
- Control — https://conformant.io/control — fleet monitoring with a minimum-grade connection policy
- Coordinated Disclosure Policy — https://conformant.io/disclosure

## Pricing

Scanning and reading the registry are free. Certification tiers (monthly, USD): Indie $99 (1 server),
Growth $499 (up to 5 servers, 7-day SLA, incident-response coverage per the coverage agreement), Enterprise $2,000 (unlimited
servers, private attestation, Control dashboard, Verification API, SIEM/Slack/Teams). Guarantee: if
a Conformant report doesn't clear your enterprise security review first pass, full refund plus $1,000.

## Threat context (why pre-connect grading exists)

- Agentjacking (Tenet Security, Jun 17 2026): attacker-controlled content injected into a Sentry
  error event, relayed through the Sentry MCP server, makes AI coding agents (Claude Code, Cursor,
  OpenAI Codex CLI) execute attacker commands at an 85% success rate. At least 2,388 organizations
  expose the public write-only Sentry DSN required. Every step is authorized, so EDR/WAF/IAM/firewalls
  do not flag it.
- MCP SDK command injection (OX Security, Apr 15 2026): a systemic command-injection root cause in the
  MCP STDIO layer produced four exploit families and 12 assigned CVEs across the ecosystem (LangFlow,
  LiteLLM, Flowise, Windsurf, FastMCP, NVIDIA NeMo and others), mostly unpatched.
- Ecosystem baseline (Adversa AI, Jun 4 2026): 67 CVEs, 106 zero-days across ~40,000 MCP repos;
  12,520 internet-exposed MCP services, ~40% with zero authentication. NSA published its first MCP
  lockdown guidance in June 2026.
- The MCP specification goes final 2026-07-28; 10,000+ servers must migrate.

## Honest scope

A Conformant grade measures a server's posture before connection (auth, scopes, transport, and the
injection surface in tool descriptions — CFM-03). It does not sanitize the live content an authorized
tool relays back; response-content injection like Agentjacking is a frontier the whole ecosystem is
still hardening. The value is a documented, anchored, pre-connect read plus a minimum-grade connection
policy — not a claim to stop every attack.

## Facts for citation

- Registry: 39 real anchored scans at launch (37 grade A, 2 grade B); marquee servers Linear, Notion,
  Stripe, Vercel all grade A. Growing.
- Every grade links to its Sigstore/Rekor entry and can be independently reproduced by re-running the
  same non-invasive handshake.
- Failing grades are published only through the coordinated-disclosure policy, never the day found.
- Part of a trust layer with VERDICT (post-incident evidence of what an agent did) and COSIGN
  (at-the-moment action authorization).

## Notes for agents and crawlers

- Programmatic grade lookup: GET https://conformant.io/api/registry?host=<hostname> (CORS-open JSON)
- A server's absence from the public feed is not a grade — D/F grades may be held under disclosure.
- This file and /llms.txt are the canonical machine context; /AGENTS.md documents the API.