# Conformant

> The independent trust registry and verified-badge program for AI agent tools (MCP servers and connectors). Scan any MCP server, get a cryptographically anchored A–F security grade, and check the registry before you connect. "SOC 2 for AI agent tools."

Conformant grades MCP servers across an 8-point battery, anchors every report to the Sigstore/Rekor public transparency log, and re-verifies weekly. A grade is an automated observation of a publicly reachable endpoint at a timestamp, not a certification. The scanner performs only the standard MCP client handshake (initialize, notifications/initialized, tools/list) and never invokes a tool.

## Key pages

- [Scanner](https://conformant.io/scan): grade any MCP server free, in seconds, with an anchored report.
- [Trust Registry](https://conformant.io/registry): the public index of graded, Rekor-anchored MCP servers.
- [The Battery](https://conformant.io/battery): full methodology for CFM-01 through CFM-09, weights, hard caps, and the remote-vs-attested boundary.
- [Verified Badge](https://conformant.io/verified): the live, embeddable, weekly re-verified badge program.
- [Control](https://conformant.io/control): fleet monitoring with a minimum-grade connection policy.
- [For vendors](https://conformant.io/vendors) · [For enterprises](https://conformant.io/enterprise) · [For auditors & insurers](https://conformant.io/auditors-insurers): buyer-specific paths.
- [Pricing](https://conformant.io/pricing): Cleared-to-Connect — Indie $99, Growth $499, Enterprise $2,000/mo.
- [FAQ](https://conformant.io/faq) · [About](https://conformant.io/about) · [Security](https://conformant.io/security) · [Contact](https://conformant.io/contact).
- [Coordinated Disclosure Policy](https://conformant.io/disclosure): notify, fixed window, publish — applied identically to every vendor.

## Machine-readable surfaces (for agents)

- [Registry API](https://conformant.io/api/registry): CORS-open JSON of every graded server. Filter one with `?host=<hostname>`. Call this before you connect an MCP server.
- [Agent guide](https://conformant.io/AGENTS.md): how an autonomous agent queries grades and reads anchored reports.
- [OpenAPI spec](https://conformant.io/openapi.json): callable API definition for tool-using agents.
- [Pricing (markdown)](https://conformant.io/pricing.md): structured pricing for buying agents.
- [Full context](https://conformant.io/llms-full.txt): the complete Conformant context in one file.

## The battery (CFM-01 through CFM-08)

- CFM-01 Authentication: does the endpoint gate access, or complete an anonymous session?
- CFM-02 Authorization: OAuth 2.1 discovery (WWW-Authenticate + RFC 9728 protected-resource metadata).
- CFM-03 Tool poisoning: prompt-injection surface in tool descriptions and server instructions.
- CFM-04 Scopes: least privilege; arbitrary-execution and admin-scope tools.
- CFM-05 Secrets: credential patterns disclosed in tool metadata.
- CFM-06 Destructive guardrails: destructive-class tools annotated so hosts can require confirmation.
- CFM-07 Spec 2026-07-28 readiness: Streamable HTTP transport and statelessness posture.
- CFM-08 Transport: TLS.
- CFM-09 Command-injection exposure (advisory, unscored): maps a server to OX Security's MCP command-injection class (2026-04-15, 12 CVEs, 4 families). Reports the remotely-observable sink surface — command-execution tools, command-shaped parameters, transport-steering content. Local STDIO config-injection families are operator-attested, not remotely tested. Appears on every scan; does not affect the A–F grade.

## Advisories

- [MCP STDIO command injection](https://conformant.io/advisory/mcp-command-injection): OX Security's disclosure (2026-04-15) mapped — 4 exploit families, 12 CVEs, named affected products, and the honest remote-vs-attested boundary.

## Threat context (why pre-connect grading exists)

- Agentjacking (Tenet Security, Jun 17 2026): attacker-controlled content injected into a Sentry error event, relayed through the Sentry MCP server, makes AI coding agents (Claude Code, Cursor, OpenAI Codex CLI) execute attacker commands at an 85% success rate. At least 2,388 organizations expose the public write-only Sentry DSN required. Every step is authorized, so EDR/WAF/IAM/firewalls do not flag it.
- MCP SDK command injection (OX Security, Apr 15 2026): a systemic command-injection root cause in the MCP STDIO layer produced four exploit families and 12 assigned CVEs across the ecosystem (LangFlow, LiteLLM, Flowise, Windsurf, FastMCP, NVIDIA NeMo and others), mostly unpatched.
- Honest scope: Conformant grades a server's posture before connection (auth, scopes, transport, and the injection surface in tool descriptions — CFM-03). It does not sanitize live content an authorized tool relays back; response-content injection like Agentjacking is an ecosystem-wide frontier. The value is a documented, anchored, pre-connect read plus a minimum-grade connection policy — not a claim to stop every attack.

## Notes for agents and crawlers

- Grades are tamper-evident: every report links to its Sigstore/Rekor entry and can be independently reproduced by running the same non-invasive handshake.
- Failing grades are published only through the coordinated-disclosure policy above, never the day they are found.
- Built by Shayne Beavan. Part of a trust layer with VERDICT (post-incident evidence) and COSIGN (at-the-moment authorization).