WEDJAT For registry operators

A verify signal you can put next to a listing.

You list MCP servers. Sooner or later someone asks which of them can be trusted, and answering that yourself turns a registry into a referee. This is an outside measurement you can read for free, show beside a row, and recompute yourself without trusting us.

The problem it solves for you, specifically

A registry that grades its own listings has taken a side. Every complaint about a bad server becomes a complaint about your judgement, every good verdict looks like promotion, and the moment money touches the list the grade is worthless. The way out is a measurement made by someone who is not you, does not rank, and does not sell placement.

That is the only role this gate wants. It measures conformance and disclosure, publishes what it found, and says nothing about whether a server is good, safe, or worth using. It is not an endorsement and never renders one.

What one lookup returns

verified: true only on a full pass. null otherwise. Never false. A server we have not measured, could not reach, or measured as incomplete all come back null, because those are different from failing and none of them is your reader's problem to untangle.
state: verified, pending, or held. Held means the instrument could not measure, not that the server is bad. It is reported rather than hidden.
measured_at: When that verdict was taken. A green with no timestamp is decoration.
record_sha256: The hash of the verdict. Strip two fields, serialize, hash, compare. If it does not match, we altered the record and you caught us.

Why never false

A boolean that can be false invites a registry to render a red mark next to a server whose only sin is that nobody measured it. Absence is not a negative verdict, so the field cannot express one.

Two calls, no key, no account

One server

# reads the register, does not measure
GET https://gate.horizonshield.dev/is-verified?endpoint=<url>

A page of servers

# up to 50 endpoints per call
POST https://gate.horizonshield.dev/feed/batch
{"endpoints": ["https://a/mcp", "https://b/mcp"]}

A fresh measurement instead of the stored one

POST https://gate.horizonshield.dev/check
{"endpoint": "https://a/mcp"}

# by default this calls no tool on the server it is pointed at.
# determinism stays unmeasured unless the owner has given consent.

The machine readable spec is at /spec and is MIT. There is a badge endpoint if you would rather render an image than style the state yourself.

What it deliberately does not do

It does not rank, order, or score for placement. There is no paid tier that moves a condition.
It does not verify that any price, figure, or answer a server returns is correct.
It does not judge whether a declared compensation structure is honest. Only the absence of disclosure counts against a server.
It does not call tools on a server without the owner's recorded consent, so determinism comes back as not measured rather than guessed.
It does not treat an unmeasured server as a failing one, anywhere in the API or the register.

Reasons to check us rather than believe us

Every claim below is either reproducible from your own terminal or visible in a public record.

The verdict recomputes. Strip record_sha256 and recompute_note, serialize compactly as UTF-8 with keys in the printed order and non-ASCII left alone, and hash. It matches in Python, not only in the runtime that produced it.
The canonicalization is pinned. We measured our own RFC 8785 implementation against an independent one and matched 11 of 12 vectors. The one we failed had hashed a value we ourselves had silently altered. Thirteen vectors are now public domain, and an endpoint that violates RFC 7493 on purpose is kept running so you can test your own canonicalizer instead of ours.
The gate is on its own list. It failed its own conditions on the first run, sat as held for days because a Cloudflare Worker cannot measure its own zone, and only went green on 2026-08-23 after the probe path was moved off Cloudflare entirely. The failing records are still in the history.
We publish retractions. On the morning of 2026-08-23 we published a limitation claiming a class of rounding error was undetectable in JavaScript. A reader asked whether that was actually true. It was not, it was fixed the same day, and the original claim is still on the page.

Where this actually stands today

Small, and stated plainly rather than dressed up. These are the real numbers on 2026-08-23.

rows verified

row pending, in public

13/13

JCS conformance vectors

verdicts requested so far for a server outside our own zone

That last number is the honest one

Nobody outside this operator has used it yet. We publish that count at /usage rather than describing the project with an adjective, and until it moves we do not call this infrastructure. You would be the first, which is worth knowing before you decide, and is exactly the sort of thing a register that hides nothing has to tell you.

Terms

Free to read, permanently, including the listing itself. No key, no account, no rate card.
Nothing about the verdict is for sale. What is sold, separately, is measurement cadence and a webhook when a condition actually flips.
Read only. The gate connects to servers, it does not modify anything on them.
If you integrate and later want out, nothing is locked. The spec is MIT and the vectors are public domain.