Skip to content
Vouchity

Developer & agent API

Vet any MCP server, programmatically

One JSON call returns the Trust Score, signal breakdown and risk flags for any server Vouchity tracks. No key required for the public endpoints, CORS is open, and there's a hosted MCP server so an agent can vet a tool before it ever calls it.

REST API — base URL

https://www.vouchity.com/api/v1

Please attribute results to "Vouchity (https://www.vouchity.com)". Trust Scores are automated heuristics from public metadata, not a security audit.

Authentication & rate limits

The public endpoints work with no key at 100 requests/day per IP, with attribution. Pro accounts can mint a personal key in Settings for 50,000 requests/day, sent as a bearer token.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://www.vouchity.com/api/v1/servers?limit=5"

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers. An invalid or revoked key returns 401; exhausting the daily budget returns 429 with a Retry-After header.

List & search servers

GET /servers

  • search — full-text search over name, description and tags (e.g. postgres)
  • category — restrict to one registry category (e.g. developer-tools)
  • grade — filter by letter grade (A–F)
  • limit / offset — pagination (limit 1–100, default 20)
curl "https://www.vouchity.com/api/v1/servers?category=data-databases&grade=B&limit=5"

Get one server's Trust Score

GET /servers/{slug}

curl "https://www.vouchity.com/api/v1/servers/ai-smithery-browserbasehq-mcp-browserbase"

Response (real, live data)

{
  "data": {
    "slug": "ai-smithery-browserbasehq-mcp-browserbase",
    "name": "Browserbasehq MCP Browserbase",
    "namespace": "ai.smithery",
    "description": "Provides cloud browser automation capabilities using Stagehand and Browserbase, enabling LLMs to i…",
    "category": "cloud-devops",
    "official": false,
    "registryStatus": "active",
    "version": "2.2.0",
    "transports": [
      "streamable-http"
    ],
    "isRemote": true,
    "install": [],
    "remoteEndpoint": "https://server.smithery.ai/@browserbasehq/mcp-browserbase/mcp",
    "repository": "https://github.com/browserbase/mcp-server-browserbase",
    "trust": {
      "score": 89,
      "grade": "A",
      "verdict": "Trusted",
      "coverage": 5,
      "signals": {
        "maintenance": {
          "score": 100,
          "evidence": "Last updated 5 days ago."
        },
        "adoption": {
          "score": 95,
          "evidence": "3,394 GitHub stars."
        },
        "transparency": {
          "score": 87,
          "evidence": "Apache-2.0 license, public source, versioned releases."
        },
        "security": {
          "score": 84,
          "evidence": "Requires authentication. Automated heuristic, not a manual audit."
        },
        "provenance": {
          "score": 72,
          "evidence": "Active in the official registry, namespaced publisher."
        }
      },
      "flags": []
    },
    "signals_raw": {
      "stars": 3394,
      "weeklyDownloads": null,
      "license": "Apache-2.0",
      "lastUpdated": "2026-07-01T20:28:41Z",
      "archived": false,
      "authRequired": true
    },
    "url": "https://www.vouchity.com/mcp/ai-smithery-browserbasehq-mcp-browserbase",
    "updatedAt": "2025-10-16T21:51:16.500712Z"
  },
  "meta": {
    "attribution": "Data from Vouchity — https://www.vouchity.com"
  }
}

Hosted MCP server — for agents

Vouchity also runs its own MCP server so an agent can vet another server without ever leaving the protocol it already speaks. It's a read-only, unauthenticated streamable-HTTP endpoint (JSON-RPC 2.0 over POST) at:

https://www.vouchity.com/api/mcp

Point any MCP-capable client at that URL and call initialize, then tools/list to discover the tools below, and tools/call to use one:

curl -X POST "https://www.vouchity.com/api/mcp" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_trust_score","arguments":{"slug":"ai-smithery-browserbasehq-mcp-browserbase"}}}'

search_mcp_servers

Search the Vouchity registry for MCP servers by keyword, category or minimum Trust Score. Returns a compact candidate list an agent can pick from before vetting one in detail with get_trust_score.

get_trust_score

Get the full Vouchity Trust Score verdict for one MCP server: the 0-100 score, letter grade, every scored signal with its evidence, risk flags, install command and source repository. Call this before installing or recommending a server.

check_server_safety

Plain-English answer to "is this MCP server safe to install?" for a server identified by name, repo URL or package identifier. Best-effort fuzzy match against the registry.

A plain GET on the same URL returns a human-readable description of the endpoint and its tools — useful as a health check or a quick sanity read before wiring it into a client.

For AI agents & answer engines

Vouchity publishes an llms.txt describing both the REST API and the hosted MCP server, so language models and autonomous agents can discover them and ground a "should I install this MCP server?" decision in a real, sourced Trust Score. Every server page also carries JSON-LD so answer engines can cite it directly.