Find an MCP server, and check it before you connect it
The MCP Server & Agent-Skill Registry API helps you discover and vet MCP servers and agent skills as clean JSON.
6 active endpoints, on 0, 1 and 2 credit tiers.
- POST/mcp-registry/v1/search
- POST/mcp-registry/v1/server_detail
- POST/mcp-registry/v1/skill_detail
- POST/mcp-registry/v1/security_signals
- POST/mcp-registry/v1/trending
- POST/mcp-registry/v1/list_sources
What MCP Server & Agent-Skill Registry endpoints does ReefAPI ship?
6 live read endpoints. Read-only data API: no writes, no account actions, no dashboard access on the target site.
MCP Server & Agent-Skill Registry API
3 of 6 endpoints, ready to run
Servers matching a query across registries, each with its description, transport, licence, sources and how many registries list it.
{ "ok": true, "meta": { "api": "mcp-registry", "endpoint": "search", "mode": "live", "latency_ms": 1031.3, "record_count": 25, "cache_hit": false, "completeness_pct": 66.67 }, "data": { "query": "web scraping", "type": "mcp", "results": [ { "id": "smithery:exa", "name": "Exa Search", "title": "Exa Search", "type": "mcp", "description": "Fast, intelligent web search and web crawling. Get fresh information about libraries, APIs, and SDKs.", "github_url": null, "license": null, "version": null, "transport": [ "http" ], "status": null, "updated_at": "2024-12-13T15:46:50.750Z", "sources": [ "smithery" ], "cross_registry_count": 1, "source_urls": { "smithery": "https://exa.ai" }, "metrics": { "use_count": 9181, "verified": true, "score": 0.02441520467836257 } }, { "id": "smithery:keenable/web-search", "name": "Keenable Web Search", "title": "Keenable Web Search", "type": "mcp", "description": "Docs: https://docs.keenable.ai/mcp-server\n\nKeenable is a free, remote MCP server that gives agents access to the web index. Search the web with ranked results and date/site filters, then fetch any indexed page as clean markdown. Works out of the box with no account or API key.\n\nTools:\n- search_web_pages: Search the web and return ranked results.\n- fetch_page_content: Fetch an indexed URL and extract its content as clean markdown", "github_url": null, "license": null, "version": null, "transport": [ "http" ], "status": null, "updated_at": "2026-06-18T17:03:59.643Z", "sources": [ "smithery" ], "cross_registry_count": 1, "source_urls": { "smithery": "https://keenable.ai/" }, "metrics": { "use_count": 2746, "verified": true, "score": 0.013513513513513514 } }, { "id": "smithery:zlurp/zlurp", "name": "zlurp", "title": "zlurp", "type": "mcp", "description": "Web scraping for AI agents. Convert any URL to clean markdown via x402 micropayments on Base.", "github_url": null, "license": null, "version": null, "transport": [ "http" ], "status": null, "updated_at": "2026-05-13T22:45:45.331Z", "sources": [ "smithery" ], "cross_registry_count": 1, "source_urls": { "smithery": "https://zlurp.ai/" }, "metrics": { "use_count": 2458, "verified": false, "score": 0.03736413043478261 } } ], "total": 25, "source_health": { "official": "ok", "glama": "http_401", "smithery": "ok" } } }
How the MCP Server & Agent-Skill Registry API works
MCP Server & Agent-Skill Registry is a normal ReefAPI surface — the same four rules that hold for every other engine on the key.
No OAuth app, no request signing, no per-site account. One key covers all 184 engines.
Every route is a POST with a JSON body. Parameters are validated against the published schema before anything is charged.
Credits, not seats. Failed and blocked calls are never charged, and cache hits cost nothing.
One envelope everywhere. meta carries latency_ms, record_count and the endpoint that answered.
Choosing between four servers that claim to do the same thing
An MCP server runs with whatever access you give it. Picking one from a list of names is a security decision dressed up as a package choice.
{"query": "web scraping"}Returns candidates across registries with a cross-registry count on each — listed in several places is a weak but real corroboration signal.
{"id": "…"}For the shortlist. Returns signals such as no clear licence, each with a severity and an explanation of why it matters.
The registries themselves do not agree on what exists, so searching one and stopping is how you miss the maintained option. This searches them together and reports which found what.
curl -X POST https://api.reefapi.com/mcp-registry/v1/search \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"query":"filesystem","limit":10}'{
"ok": true,
"data": { … },
"meta": {
"api": "mcp-registry",
"endpoint": "search",
"mode": "live",
"latency_ms": …,
"record_count": …
},
"error": null
}Where a row came from, and what that source can tell you
Rows from different registries are normalized into one shape but they are not equally complete, and the id prefix tells you which one you are looking at before you read anything else. Every row below was measured on 2026-08-27.
| id shape | Source | What it carries, and what it does not |
|---|---|---|
| github.com/owner/repo | Any source, once a GitHub repo is known | The canonical join key. This is the most reliable value to pass to server_detail |
| smithery:<qualifiedName> | Smithery | use_count, verified and score. github_url, license, version and status were all null on 8 of 8 rows |
| official:<io.github.Owner/name> | Official MCP Registry | version and status 'active', transport stdio or sse. metrics came back as an empty object |
| github.com/owner/repo, type skill | GitHub | license (MIT on all four measured), stars and forks, transport ['skill'] |
| transport values seen | Across all sources | http (Smithery), stdio and sse (Official), skill (GitHub skills) |
| source_health | Returned inside every search | official ok, smithery ok, glama http_401 on every call made |
| completeness_pct | Drops when a source is unreachable | 66.67 with source=all, 100.0 with source=official |
| license vs license_raw | repo_health separates the parsed value from the raw one | license null while license_raw read NOASSERTION on a repo with a non-standard license |
| cross_registry_count | How many registries list the same server, a corroboration signal | 1 on every search row measured, and 0 on a server_detail lookup |
| security_signals | Heuristics plus a disclaimer, never a certification | 2 signals, both severity 'info': no_clear_license and single_registry |
Six sources are declared by list_sources but only three were answering: Official, Smithery and the GitHub API. Glama returned http_401 on every call, PulseMCP is key-gated with its old endpoint retired, and MCP.so is listed as deferred. Read source_health on every response rather than assuming a quiet source means a small result.
What is aggregated, and what the security signals are worth
Measured on searches and on a well-known server. The signals row is the engine's own caveat.
Results are merged across registries with the sources named on each entry and a cross-registry count. The response also reports per-source health, so a registry that was unreachable during your search is visible rather than silently reducing your results.
The signals come with an explicit disclaimer stating they are derived from public metadata. They catch real things — a missing licence, thin provenance — each with a severity and a plain explanation, and they are the right first filter. They are not an audit of what the server's code does when you connect it, and nothing here should be read as one.
For servers backed by a public repository, the detail endpoint can include activity and maintenance signals. For a component that runs inside your agent, when it was last touched is at least as informative as its description.
The same search covers skills, not only servers, which is the other half of the ecosystem and is generally listed in different places from the servers.
The security-signals call took around ten seconds, because it goes out to the repository and to the registries to corroborate. Search is quick; treat the per-server deep check as a step you run on a shortlist, not on every result.
What people build with MCP Server & Agent-Skill Registry
The jobs this data is most often used for.
endpoints
credits per call
AI-agent platforms call search to let users discover MCP servers by capability and transport.
Security-conscious teams use security_signals to vet an MCP server before connecting it.
Developer tools use trending and server_detail to surface and compare popular MCP servers.
What MCP Server & Agent-Skill Registry data costs
The cheapest call here is 0 credits, so $15/mo (Pro) buys 10,000 of them — $1.50 per 1,000 credits. Credits roll over and never expire, and failed or blocked calls are not charged.
Full pricing →- 1,000 free credits on signup, no card
- One key, all 184 APIs, one credit pool
- Failed and blocked calls are never charged
- Credits roll over and never expire
Call it in two lines
Sign up, get 1,000 credits and one key that works on every engine. Then this is the whole protocol.
curl -X POST https://api.reefapi.com/mcp-registry/v1/search \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"query":"filesystem","limit":10}'import requests
r = requests.post(
"https://api.reefapi.com/mcp-registry/v1/search",
headers={"x-api-key": REEF_KEY},
json={
"query": "filesystem",
"limit": 10
},
)
print(r.json()["data"])Have a question? We got answers.
The questions people actually ask before wiring up MCP Server & Agent-Skill Registry.
Get a free key →Which registries are actually live right now?▾
Check source_health, which ships inside every search response rather than being something you have to ask for. On 2026-08-27 it read official ok, smithery ok, glama http_401, and completeness_pct fell to 66.67 as a result. list_sources reports the full roster with a reachable flag, including two that are declared but not serving: PulseMCP (its open endpoint retired, the current one key-gated) and MCP.so (deferred). A search that looks thin is often a source outage, not a thin ecosystem.
Why does searching for 'filesystem' return Google Drive and Cloudinary?▾
Because Smithery ranks semantically rather than by substring, and its rows dominate a default search by use_count. A query of 'filesystem' returned Google Drive (use_count 8,569), OneDrive (2,146) and Cloudinary (3), none of which contain the word. Set source to 'official' for a literal match: the same query against the Official registry alone returned com.pulsemcp/remote-filesystem, io.github.Digital-Defiance/mcp-filesystem and a chroot filesystem jail server, at completeness_pct 100.
Why is github_url null on so many rows?▾
Because Smithery does not publish a repository URL in its listing, and github_url is the key the deduplication uses to recognize the same server across registries. No repo URL means no join, which is why those rows come back with cross_registry_count 1 and sources ['smithery'] even for servers that plainly exist elsewhere. A null github_url is a limit of the upstream listing, not evidence that a server has no repository.
What does cross_registry_count mean, and why was it 0 on a lookup?▾
It counts how many of the aggregated registries list the same server, and it is meant as a corroboration signal: a server listed in three places has been through three sets of eyes. A server_detail lookup on github.com/modelcontextprotocol/servers returned sources [] and cross_registry_count 0 while repo_health filled in normally (89,889 stars, 549 open issues, not archived). That combination means the GitHub enrichment succeeded and no registry currently carries a matching entry under that repo URL, so read it as 'uncorroborated', not 'nonexistent'.
Is security_signals a safety check?▾
No, and it says so in a disclaimer returned with every call. It is a heuristic pass over public metadata and the tool manifest, flagging permission breadth, credential requests, repo health and cross-registry corroboration. Scanning the reference server repo produced exactly two signals, both severity 'info': no_clear_license and single_registry, with highest_severity 'info'. Zero signals is not a clean bill of health, and an info-level signal is not an accusation. Read the source before you hand any server your credentials or your filesystem.
Why is license null on a repo that clearly has one?▾
The parsed field and the raw field are kept apart on purpose. repo_health returns license null alongside license_raw NOASSERTION for the reference server repo, which is what GitHub reports when a repository's licensing does not resolve to a single recognized SPDX identifier, often because the license sits per-subdirectory. Skill rows behave differently: all four measured returned a clean MIT in `license`. Use license for filtering and license_raw when you need to know why the filter came up empty.
What does skill_detail add over a plain repo lookup?▾
It reads the SKILL.md frontmatter as well as the repo. On anthropics/skills it returned skill_md.found false with an empty frontmatter object, alongside a fully populated repo_health (171,816 stars, topics ['agent-skills'], default_branch main). found false means there is no SKILL.md at the repository root, which is normal for a monorepo holding many skills in subdirectories, and it is a signal about layout rather than a failure.
How does trending differ from search sorted by popularity?▾
trending states its own basis in the response: 'Smithery useCount + Official-registry active/latest'. It blends the most-used Smithery servers with the newest Official-registry entries rather than ranking one result set, so it surfaces both established servers (a search server at 87,579 uses, Gmail at 57,738, Google Sheets at 56,138) and freshly published ones with no usage history yet. Set type to 'skill' and it switches to recently created GitHub skill repositories instead.
What is the MCP Server & Agent-Skill Registry API?▾
MCP Server & Agent-Skill Registry API is a ReefAPI endpoint group for mcp server & agent-skill registry It returns live JSON through POST requests under /mcp-registry/v1.
Is the MCP Server & Agent-Skill Registry API free to try?▾
Yes. ReefAPI starts with 1,000 free credits, no card required. MCP Server & Agent-Skill Registry calls use the same shared credit balance as every other ReefAPI engine.
Do I need a MCP Server & Agent-Skill Registry login or account?▾
No login to MCP Server & Agent-Skill Registry is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the MCP Server & Agent-Skill Registry data?▾
The page example is captured from a live search call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the MCP Server & Agent-Skill Registry API use?▾
MCP Server & Agent-Skill Registry actions currently cost 1-2 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
Can I call MCP Server & Agent-Skill Registry from an AI assistant or MCP client?▾
Yes. Connect ReefAPI once through MCP and your assistant can call mcp-registry actions with the same key, credit pool and JSON envelope used by normal REST requests.
18 Developer Tools APIs on the same key
One key, one credit pool, one response envelope. If you are pulling MCP Server & Agent-Skill Registry, you are one call away from the rest of the category — no second contract, no second integration.
Need something this API does not do?
Name the endpoint, the field, or a source we do not carry yet. We ship new APIs every week and you would be first to get the key. Real people read every message and reply the same day.
Try it on your own data before you pay anything
The call above is the real endpoint, not a recording. A free key gives you 1,000 credits, the other 183 APIs, and the same envelope everywhere.
Endpoints, parameters and credit costs on this page are read from the live catalog and cannot drift from what the API accepts. Field notes were captured on 2026-08-30.