{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_cstzscekxrt8","handle":"xone-mcp-risk-index","url":"https://wellknown.network/agents/xone-mcp-risk-index","links":{"self":"https://wellknown.network/agents/xone-mcp-risk-index/record.json","html":"https://wellknown.network/agents/xone-mcp-risk-index","markdown":"https://wellknown.network/agents/xone-mcp-risk-index/record.md","api":"https://wellknown.network/api/v1/agents/xone-mcp-risk-index","status":"https://wellknown.network/api/v1/agents/xone-mcp-risk-index/status","claim":"https://wellknown.network/agents/xone-mcp-risk-index/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/xone-mcp-risk-index/claim.json","badge":"https://wellknown.network/agents/xone-mcp-risk-index/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:xone-mcp-risk-index","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"xone-mcp-risk-index","summary":"Evidence-backed MCP server risk signal catalog and local CLI.","description":"# mcp-risk-index\n\nLanguages: English | [中文](./README.zh-CN.md)\n\nAn open risk index for common MCP servers, permissions, commands, and maintenance signals.\n\n## Status\n\n`v0.3.1` - evidence-backed catalog rendering with reviewer questions, strict review checks, and refreshed public sample metadata.\n\n## Purpose\n\nConvert `mcp-audit` rule experience into a reusable public data asset without unsupported claims.\n\n## First Production Surface\n\nVersioned data catalog with evidence-backed entries and a deterministic local CLI.\n\nFrom PyPI:\n\n```bash\npython3 -m pip install xone-mcp-risk-index\nmcp-risk-index init --output mcp-risk-index.catalog.yml\nmcp-risk-index validate --catalog mcp-risk-index.catalog.yml --strict\nmcp-risk-index render --catalog mcp-risk-index.catalog.yml --format markdown --output mcp-risk-index.md\nmcp-risk-index render --catalog mcp-risk-index.catalog.yml --format json --output mcp-risk-index.json\n```\n\nFrom Homebrew:\n\n```bash\nbrew install x-one-ai/tap/mcp-risk-index\nmcp-risk-index --version\n```\n\nFrom a source checkout, you can also validate the bundled catalog:\n\n```bash\nmcp-risk-index validate --catalog data/catalog.yml --strict\nmcp-risk-index render --catalog data/catalog.yml --format markdown --output mcp-risk-index.md\nmcp-risk-index render --catalog data/catalog.yml --format json --output mcp-risk-index.json\n```\n\nFor local development:\n\n```bash\npython3 -m pip install -e '.[dev]'\npython3 -m pytest tests -q\n```\n\n## Catalog Contract\n\nThe bundled catalog uses `mcp-risk-index.catalog.v1`. Each entry records identity, package, launch command, permissions, maintenance facts, review-level risk signals, evidence, and limitations. Rendered Markdown and JSON also include reviewer questions derived from the evidence-backed signals.\n\nReview levels are prompts for human inspection:\n\n- `info`: useful context\n- `review`: inspect before adoption\n- `high-review`: require explicit owner approval\n\nThey are not safety scores.\n\nStrict validation requires production review gover…","publisher":{"name":"X-One-AI","url":null},"homepage":"https://github.com/X-One-AI/mcp-risk-index","repository":"https://github.com/X-One-AI/mcp-risk-index","version":"0.3.1","license":null,"protocols":["mcp"],"tags":["mcp","security","ai","catalog","risk"],"pricing":null,"endpoints":[{"url":"pypi:xone-mcp-risk-index","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"commerce.ecommerce","name":"E-commerce Operations","confidence":1,"provenance":"declared"},{"slug":"security.identity","name":"Identity & Access","confidence":0.859,"provenance":"derived"},{"slug":"ai.prompting","name":"Prompt Management","confidence":0.791,"provenance":"derived"},{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":0.768,"provenance":"derived"}],"categories":["ai","commerce","dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"xone-mcp-risk-index","registry":"pypi","observedAt":"2026-09-10T16:24:21.960Z","publishedAt":"2026-06-14T16:06:11.834593Z","latestVersion":"0.3.1"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"xone-mcp-risk-index","url":"https://pypi.org/project/xone-mcp-risk-index/","firstSeenAt":"2026-09-10T16:23:01.555Z","fetchedAt":"2026-09-10T16:23:01.555Z","normalizedAt":"2026-09-10T16:23:01.555Z"}]},"firstSeenAt":"2026-09-10T16:23:01.555Z","updatedAt":"2026-09-10T16:24:21.960Z"}