Trust Index API

Check any MCP server's security score and per-control summary from your own tools — CI gates, procurement review, agent allow-lists. Key-authenticated and rate-limited.

Keys are issued after a short review. Already have one? Use it as a Bearer token below.

Authentication

Pass your key as a Bearer token. Keep it secret; requests are rate-limited per key.

Authorization: Bearer canopii_live_xxxxxxxxxxxxxxxx

Look up a server

Servers are identified by their registry name (namespace/name).

curl -H "Authorization: Bearer $CANOPII_KEY" \
  https://index.canopii.dev/api/v1/servers/io.github.owner/server-name

Example response:

{
  "server": "io.github.owner/server-name",
  "version": "1.4.0",
  "score": 92,
  "grade": "A",
  "confidence": 98,
  "tier": 1,
  "scoredAt": "2026-07-02T10:24:31.000Z",
  "scoringVersion": "2.6.0",
  "capabilities": { "tools": ["search", "fetch"], "resources": [], "prompts": [] },
  "controls": [
    { "id": "code.no_command_injection", "title": "No command-injection sinks", "status": "pass", "guard": true },
    { "id": "supply.no_known_vulns", "title": "No known-vulnerable dependencies", "status": "warn", "guard": false }
    // …one entry per control
  ]
}

Responses & limits

200 — server found and scored.
404 — unknown or not-yet-scored server.
401 — missing, invalid, or revoked key.
429 — rate limit exceeded; check the Retry-After header. Default limits are 60 requests/minute and 5,000/day (per key; adjustable on request).

The API returns the score, grade, confidence, tier, declared capabilities, and a pass/warn/fail summary for every control. See how scores are calculated.