# MCP Server & Agent-Skill Registry API — discover, search and inspect Model Context Protocol (MCP) servers and agent skills across the Official MCP Registry, Glama and Smithery, with risk signals and trending

> Normalized cross-registry search over the Official MCP Registry, Glama and Smithery (and skills via GitHub). Dedups the same server across registries by canonical GitHub repo and returns cross-registry presence.
> ReefAPI engine `mcp-registry` · 6 endpoints · clean JSON, no scraping or browsers to manage.

## How to call
- **Endpoint:** `POST https://api.reefapi.com/mcp-registry/v1/<action>` with a JSON body.
- **Auth:** header `x-api-key: <YOUR_REEFAPI_KEY>` — create one free (1,000 credits, no card): https://reefapi.com/signup
- **Response (every call):** `{ ok: boolean, data: ..., meta: { record_count, credits, ... }, error: { code, message } }` — branch on `ok`. Failed or blocked calls are free.
- **One key + one shared credit pool** across every ReefAPI API. Per-call credits are listed on each endpoint below.
- **Use it from an AI agent (MCP):** connect `https://api.reefapi.com/mcp` (remote streamable-http, `Authorization: Bearer <key>`) and your assistant can call these actions directly.

## Endpoints

### POST /mcp-registry/v1/search — 1 credit
Normalized cross-registry search over the Official MCP Registry, Glama and Smithery (and skills via GitHub). Dedups the same server across registries by canonical GitHub repo and returns cross-registry presence.

**Parameters:**
- `query` (string, required) — Free-text search (server name, capability, keyword).
- `type` (enum, optional, default "mcp") — Which ecosystem to search. [one of: mcp, skill, all]
- `source` (enum, optional, default "all") — Restrict to a single source (default: all reachable). [one of: all, official, glama, smithery]
- `sort` (enum, optional, default "relevance") — Result ordering. [one of: relevance, popularity, recent]
- `limit` (integer, optional, default 25) — Max merged results (1-100).

**Returns:** { results: [{id,name,title,type,description,github_url,license,version,transport[],status,updated_at,sources[],cross_registry_count,source_urls,metrics{use_count,stars,verified,score}}], source_health{}, total }

**Example request body:**
```json
{
  "query": "filesystem",
  "limit": 10
}
```

### POST /mcp-registry/v1/server_detail — 1 credit
Full merged profile for one MCP server across every registry it appears in: manifest (tools/capabilities/transport), install paths (packages/remotes/connections), license, GitHub repo health, and cross-registry presence (how many registries list it = trust signal).

**Parameters:**
- `id` (string, required) — A GitHub URL/slug (owner/repo), a Smithery qualifiedName, a Glama id, or an Official registry name. github_url is the most reliable (it joins all registries).
- `repo_health` (boolean, optional, default true) — Include GitHub repo-health enrichment (stars/issues/archived/license). Default true.

**Returns:** { id, name, description, github_url, license, version, transport[], status, sources[], cross_registry_count, tools[], install[], env_vars[], repo_health{}, source_urls{} }

**Example request body:**
```json
{
  "id": "github.com/modelcontextprotocol/servers"
}
```

### POST /mcp-registry/v1/skill_detail — 1 credit
Metadata for one agent-skill repo (GitHub-backed). Fetches the repo + its SKILL.md frontmatter (name/description/license) + repo health.

**Parameters:**
- `id` (string, required) — GitHub URL or owner/repo slug of the skill repository.

**Returns:** { id, name, description, license, skill_md{found,frontmatter}, repo_health{}, github_url }

**Example request body:**
```json
{
  "id": "github.com/modelcontextprotocol/servers"
}
```

### POST /mcp-registry/v1/security_signals — 2 credits
HEURISTIC risk signals for an MCP server (NOT a safe/unsafe certification). Flags permission breadth (fs/network/exec), credential/env-var requests, repo health (archived/low-adoption), prompt-injection patterns in description/manifest, and corroboration (cross-registry presence). Always returns a disclaimer.

**Parameters:**
- `id` (string, required) — GitHub URL/slug or Smithery qualifiedName of the server to scan.

**Returns:** { id, github_url, risk_signals:[{signal,severity,detail}], signal_count, highest_severity, corroboration{sources,cross_registry_count}, disclaimer }

**Example request body:**
```json
{
  "id": "github.com/modelcontextprotocol/servers"
}
```

### POST /mcp-registry/v1/trending — 1 credit
New / rising entries. MCP: most-used servers on Smithery + latest on the Official registry. Skills: recently-created GitHub skill repos.

**Parameters:**
- `type` (enum, optional, default "mcp") — Ecosystem. [one of: mcp, skill]
- `limit` (integer, optional, default 20) — Max results (1-50).

**Returns:** { results:[normalized records w/ metrics], basis, source_health{} }

**Example request body:**
```json
{
  "type": "mcp",
  "limit": 10
}
```

### POST /mcp-registry/v1/list_sources — 0 credits
The registries this engine aggregates, their roles, auth status and live reachability. Free.

**Parameters:** none

**Returns:** { sources:[{key,name,role,auth,reachable,note}] }

## More
- Try it live, no code: https://reefapi.com/playground?engine=mcp-registry
- Human docs page: https://reefapi.com/docs/mcp-registry
- Every ReefAPI API in one file (for your AI): https://reefapi.com/llms-full.txt