# Arclan MCP Registry

> Machine-evaluated registry of MCP (Model Context Protocol) servers. Every server is validated via live handshake, scored on reliability, and monitored continuously.

## 中文摘要

Arclan 是一个机器验证的 MCP（模型上下文协议）服务器注册表。每个服务器都经过实时握手验证、可靠性评分，并持续监控。Agent 可在连接未知 MCP 服务器之前，通过本注册表查询其验证状态与评分。

推荐通过 MCP 协议直接查询（端点：`https://arclan.ai/mcp`），可用工具：`query_registry`（按能力/评分/传输方式搜索）、`get_server`（查询单个服务器详情）、`recommend_server`（获取任务相关的排序推荐）、`report_server`（提交使用反馈）。也可使用 REST API，详见下方英文文档及 OpenAPI 规范（`https://arclan.ai/openapi.yaml`）。

## What this is

Arclan is an API-first registry designed for agents to query before connecting to an MCP server. Think of it as a trust layer for the MCP ecosystem — before your agent connects to an unknown MCP server, check Arclan first.

## MCP endpoint (recommended for agents)

Arclan exposes itself as an MCP server at `https://arclan.ai/mcp`. Use this to query the registry from inside an agent without leaving the MCP protocol.

Tools available:
- `query_registry` — search for validated MCP servers by capability, score, transport, production safety, or read-only status
- `get_server` — get full details, trust metrics, and test history for a specific server by URL or ID
- `recommend_server` — get ranked recommendations for a task with reason codes
- `report_server` — submit an outcome report after using a server (helps the registry track real-world reliability)

## REST API

Base URL: https://arclan.ai

- `GET /api/registry` — list servers with filtering (status, capability, min_score, production_safe, read_only, auth_type, transport)
- `GET /api/registry/{id}` — full server detail including trust metrics and test history
- `GET /api/registry/{id}/scores` — composite score breakdown (arclan + agent components)
- `GET /api/registry/{id}/health` — 30-day daily uptime and score history
- `GET /api/recommend` — ranked recommendations with reason codes
- `GET /api/stats` — global registry statistics
- `POST /api/submit` — submit a server URL for validation
- `POST /api/report` — submit an agent usage report

Full OpenAPI spec: https://arclan.ai/openapi.yaml

## Key filters

- `production_safe=true` — uptime_7d > 97% AND handshake_success_rate > 95% AND status active
- `read_only=true` — no write or exec tools detected
- `include=trust,flags` — add rolling reliability metrics and derived boolean flags to each result
- `include=flags` — also adds `securityScan` with per-tool IOC analysis (prompt injection, arbitrary execution, exfiltration, credential harvesting)

## Server states

- `active` — full MCP handshake passed, connectable
- `auth_gated` — reachable but requires credentials
- `mcp_partial` — responds to HTTP but fails full MCP compliance
- `degraded` — was active, now intermittently failing
- `stdio` — local transport only, not network callable
- `unreachable` — no HTTP response
- `invalid` — HTTP works but not an MCP server
- `zombie` — was validated, now permanently dark

## Trust signals

Every active server has rolling metrics: uptime_24h, uptime_7d, handshake_success_rate, latency_p50, latency_p95. Scores combine machine-observed validation data (80%) with agent-reported outcomes (20%).

## Security scanning

After every successful handshake, tool names and descriptions are scanned for: PROMPT_INJECTION, ARBITRARY_EXEC, EXFILTRATION, SYSTEM_ACCESS, CREDENTIAL_HARVEST. Results available via `include=flags` as `securityScan`.