# MCPSafe

> Security-first MCP server directory. Every server scanned for tool poisoning, rug pulls, and malicious behavior.

## What is MCPSafe?

MCPSafe indexes MCP (Model Context Protocol) servers and runs automated security scans on each one. Servers receive a security grade (S through F) based on analysis of tool descriptions, permission scopes, and behavioral monitoring.

## For AI Agents

MCPSafe is designed for programmatic discovery. AI agents can find safe MCP servers via:

### REST API
- GET https://mcpsafe.dev/api/v1/servers?q=database&min_security=B
- GET https://mcpsafe.dev/api/v1/servers/{slug}
- GET https://mcpsafe.dev/api/v1/servers/{slug}/security
- GET https://mcpsafe.dev/api/v1/categories

### MCP Server
MCPSafe is itself an MCP server. Connect via Streamable HTTP at:
- Endpoint: https://mcpsafe.dev/mcp

Tools available:
- search_mcp_servers: Search by query, category, security tier
- get_server_details: Get full details including security report
- get_security_report: Get detailed scan findings
- list_categories: Browse server categories

### OpenAPI Spec
https://mcpsafe.dev/api/v1/openapi.yaml

## Security Scanning

Every server is scanned for:
- Tool Poisoning Attacks (hidden instructions in tool descriptions)
- Prompt Injection (system prompt overrides, role manipulation)
- Data Exfiltration (suspicious URLs, forwarding instructions)
- Shadowing (attempts to hijack other servers' tools)
- Excessive Permissions (overly broad access scope)
- Rug Pulls (tool description changes after approval)