{
  "openapi": "3.1.0",
  "info": {
    "title": "Conformant MCP Trust Registry API",
    "version": "1.0.0",
    "description": "Public, read-only API for checking the security grade of a Model Context Protocol (MCP) server before an AI agent connects to it. Every grade is anchored to the Sigstore/Rekor public transparency log. An automated observation, not a certification.",
    "contact": { "name": "Conformant", "url": "https://conformant.io" },
    "license": { "name": "Coordinated Disclosure Policy", "url": "https://conformant.io/disclosure" }
  },
  "servers": [{ "url": "https://conformant.io" }],
  "paths": {
    "/api/registry": {
      "get": {
        "operationId": "getRegistry",
        "summary": "List graded MCP servers, or look up one by host/url.",
        "description": "Returns anchored A–F security grades for MCP servers. Call this before connecting an MCP server to an AI agent. CORS-open and cacheable. Failing (D/F) grades are held under coordinated disclosure and absent from this feed; a server's absence is not a grade.",
        "parameters": [
          { "name": "host", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter to one server by hostname (substring match), e.g. mcp.stripe.com" },
          { "name": "url", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter by full server URL (substring match)" }
        ],
        "responses": {
          "200": {
            "description": "Registry snapshot",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "registry": { "type": "string" },
                    "grading": { "type": "string" },
                    "updatedAt": { "type": "string", "format": "date-time" },
                    "count": { "type": "integer" },
                    "servers": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "server": { "type": "string" },
                          "url": { "type": "string" },
                          "host": { "type": "string" },
                          "vendor": { "type": "string" },
                          "grade": { "type": "string", "enum": ["A", "B", "C", "D", "F"] },
                          "score": { "type": "integer", "minimum": 0, "maximum": 100 },
                          "openByDesign": { "type": "boolean" },
                          "scannedAt": { "type": "string", "format": "date-time" },
                          "report": { "type": "string", "format": "uri" }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}