Evidence, not promises

Know what you're installing.

Who publishes it, where it comes from, what changed between versions, and the public evidence behind every answer. For MCP servers and developer tools, before you connect them.

Recently Verified

Servers from verified publishers, checked against public sources

View all

Important Changes

Real differences between published versions

All changes

How it works

Three steps, every statement linked to its source

  1. 1. We collect

    Every hour we read the official MCP Registry, the Docker MCP Catalog, npm, GitHub and the APIs.guru directory, and merge the same tool found in several places into one entry.

  2. 2. We check

    For each tool we look at who proved control of its namespace, where the code and packages come from, build attestations, known vulnerabilities (OSV), licence, maintenance, install scripts, and what changed between versions.

  3. 3. You decide

    Each finding shows the source address, when it was read and a fingerprint of what was read. Entries we have not checked yet say so. The published data is signed, so anyone can verify it was not altered.

Let your assistant look first

UND Assay is also an MCP server. Connect it once and your AI assistant can check a tool's publisher, source and changes before it suggests installing it. Lookups need no account.

claude mcp add --transport http und-assay https://undassay.com/mcp

Works with any client that speaks the Model Context Protocol. Other assistants and the REST API

Who uses it

Developers

Before you npx an MCP server, see who publishes it and whether a look-alike name is trying to pass as the real one.

Security and IT teams

Provenance, attestations, advisories and version-to-version changes, such as a new network host or a newly requested credential.

Tool authors

Prove your domain or GitHub account in the official MCP Registry and your tools show as from a verified publisher. Spot a mistake? Ask for a correction.

Questions

What is an MCP server?

A small program that gives an AI assistant such as Claude, ChatGPT or Cursor access to your files, accounts or services. Tens of thousands exist and anyone can publish one, so it pays to know who made the one you install.

Does UND Assay say a tool is safe?

No. It shows public evidence and where it came from, so you can decide. No warnings means nothing was found in the sources we read, not that a tool is safe.

Is it free?

Yes. Searching and every tool page are free, without an account. A free API key and the MCP lookup are free too.

Can a publisher pay to rank higher?

No. Results are ordered by relevance and evidence only. No ranking, verdict or badge is for sale.

How fresh is the data?

Sources are read on their own schedules, most every hour or day, and every page shows when its data was read. The sources page shows each source's last successful read.