Agent and MCP security

Check an MCP server or package for registry risk

Reputation for the MCP ecosystem, where dedicated security tooling is still minimal industry-wide. Checks an MCP server URL or package name against RelayShield's criminal IOC corpus, runs typosquat and near-miss detection against well-known MCP domains (edit distance 2 or less), and checks domain registration age via RDAP.

A LOW verdict means no red flags, not verified safe. Each check can only find what it looks for, and a brand-new malicious server that has not yet been reported will return LOW. When findings is empty the response carries a note saying exactly this.

Billing. $0.35 per successful call, metered to your card. Failed calls are never billed. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge. Unlike the other metered endpoints this one does not check a prepaid credit balance before running, so it never returns 402.

Note. Each of the three checks is independently fault-tolerant: an unreachable RDAP or IOC lookup is skipped rather than failing the call, so it lowers the verdict instead of raising an error. Combined with the point above, treat LOW as 'nothing found by the checks that ran'. Also billed as an AWS Marketplace Bundle D dimension for bundle customers.

post/v1/metered/mcp-registry-risk

Request

  • Base URL: https://api.relayshield.net
  • URL: https://api.relayshield.net/v1/metered/mcp-registry-risk
  • Auth: one of:
    • API key in header X-RS-API-KEY
    • API key in header X-API-Key

Request body

server_urlstring uri

Full MCP server URL. The hostname is extracted and a leading www. stripped. Supplying this enables all three checks.

package_namestring

Package name, used when there is no server URL. Package-name-only checks are limited to the IOC corpus, which has no dedicated MCP package coverage yet, so a name-only call always returns at least a package_name_only finding recording that reduced coverage.

Example request

{
  "server_url": "https://mcp.example-tools.io/sse"
}

Response

Success. ok is true and data holds the result.

oktrue required

Changes

No recorded changes to this operation across all 1 revision of this API.