Security review of a remote MCP server or SKILL.md: level, measured signals, evidence and changes.

We visit remote MCP servers: initialize and tools/list, without credentials or tool calls, again 7 days after a success. A failure needs a second check. MCP signals: dns_morto, sem_https, tls_invalido, tunel, nao_responde, nao_mcp, texto_suspeito, redireciona_fora, repo_arquivado, repo_parado, dominio_recente, login, bloqueado. For skills, tipo: skill identifies a static SKILL.md review. It flags secret reads, download-and-execute commands, external uploads, invisible characters, long encoded text and broad allowed-tools. revisao.achados supplies the path, original line, excerpt and context. Examples and prohibitions do not raise the level. Excerpts hide sensitive values. The review does not run commands or follow references. Supported source: public raw.githubusercontent.com SKILL.md. Watched, visited, starred and new skills get priority within the shared GitHub governor and a daily cap. Unread or unsupported skills remain explicitly unchecked. Local MCP servers and plugins answer nao_remoto. No request fetches a third-party source. Cached for 5 minutes. Returns: { id, conferido, motivo?, nivel, tipo?, revisao?, fonte?, caminho?, vigiavel?, sinais, servidor?, dominio?, ferramentas?, verificado_em?, proxima_em?, mudou_em?, eventos?, aviso, api }

get/api/listings/{id}/security

Request

  • Base URL: https://agentalog.com
  • URL: https://agentalog.com/api/listings/{id}/security
  • Auth: none required

Path parameters

idstring required

Listing ID, from Anuncio.id.

Query parameters

langstring

Language of the aviso sentence: en (default) or pt.

Headers

X-API-Passstring

MAT-only private pass: mat_<32 random hex>_<64 random hex>. Generate and save before buying.

Idempotency-Keystring

Optional retry key, up to 80 ASCII characters; same read for five minutes.

Response

{ id, conferido, motivo?, nivel, tipo?, revisao?, fonte?, caminho?, vigiavel?, sinais, servidor?, dominio?, ferramentas?, verificado_em?, proxima_em?, mudou_em?, eventos?, aviso, api }

idstring required

Listing ID.

conferidoboolean required

true when the MCP was visited or SKILL.md was reviewed.

motivostring

na_fila, modelo, nao_remoto, skill_na_fila, skill_sem_fonte (unsupported source) or skill_em_preparo (collection not enabled).

nivel'risco' | 'atencao' | 'ok' | '' required

risco, atencao, ok, or empty when not checked.

tipostring

skill for static SKILL.md review.

revisaoobject nullable

Skill report, or null before review: regras, texto_sha, bytes, linhas, caminho, escopo (SKILL.md), nivel, sinais, total_achados, achados_truncados; up to 50 achados with codigo, nivel, contexto (instrucao, exemplo, proibicao), caminho, linha (1-based), trecho, abreviado, redigido. The level includes all findings, including omitted findings.

fontestring

Original public SKILL.md URL.

caminhostring

SKILL.md path within its repository.

vigiavelboolean

Whether this skill can use a watch slot.

sinaisobject[] required

{ codigo, valor, rotulo?, degrau }, most serious first; degrau is risco, atencao or info; tunel carries the provider id in valor and its name in rotulo.

servidorobject

estado (ok, login, erro, nao_mcp, fora, dns, tls, bloqueado), nome, versao, protocolo, transporte, host, pais (ISO country of the IP that answered).

dominioobject nullable

Facts about the registrable domain of the address, from our domain data, or null when we know none: nome; registrado ({ desde, ate, fonte }, the window in which it was registered, from the newly registered domain lists, fonte nrd7 or nrd_faixa; null when older or unknown); organizacao (the organization of its OV/EV TLS certificate, or null); tambem_cobre ({ dominio, certificados, visto_em }, up to 10 other domains that the same TLS certificates cover — whoever requested the certificate controlled all of them); mudou_em. A registration less than 90 days old turns on the dominio_recente signal.

ferramentasobject

total (null when not read), mudou_em, capacidades, suspeitas and api (the /tools route, or null).

verificado_emstring

Last visit (ISO 8601).

proxima_emstring

Next scheduled visit (ISO 8601); empty when it is never visited.

mudou_emstring

When the level or the signals last changed.

eventosobject[]

Last 10 changes, newest first: { visto_em, tipo, de, para } — ferramentas_mudaram, estado_mudou, nivel_mudou, pais_mudou, versao_mudou, skill_texto_mudou (content hashes), skill_sinais_mudaram (signal codes).

avisostring required

What the level means and what it does not.

apistring required

Absolute URL of this route.

Changes

No recorded changes to this operation across all 1 revision of this API.