Verify every MCP server your agents connect to.

import { Strata } from '@strata-ai/sdk'

const strata = new Strata({ apiKey: process.env.STRATA_API_KEY })

const result = await strata.verify(
  'https://github.com/microsoft/playwright-mcp'
)

console.log(result.risk_level)        // 'low'
console.log(result.capability_flags)  // ['fs_write', 'net_egress']
console.log(result.security_score)    // 85
console.log(result.runtime_score)     // 72

// No API key — anonymous tier (10 req/hour per IP).
const strata = Strata.public()
await strata.verify('@modelcontextprotocol/server-filesystem')

# via npx — use @strata-ai/sdk (the bare "strata" name is taken on npm)
$ npx @strata-ai/sdk verify @modelcontextprotocol/server-filesystem
✓ @modelcontextprotocol/server-filesystem
  Risk: 🟢 low (security 85, runtime 72)
  Flags: fs_write, net_egress
  → https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem

$ npx @strata-ai/sdk verify github.com/owner/sketchy-mcp
✗ owner/sketchy-mcp
  Risk: 🔴 critical (security 12, runtime 8)
  Flags: shell_exec, dynamic_eval
  Reasons: exposes shell_exec; security_score 12 below 20

# or: npm install -g @strata-ai/sdk  →  strata verify …

$ npx @strata-ai/sdk scan
Strata MCP Security Scan
~/Library/Application Support/Claude/claude_desktop_config.json

✓ @modelcontextprotocol/server-filesystem  🟢 low      security 85, runtime 72  [fs_write]
! @scope/risky-mcp                         🟠 high     security 60, runtime 30  [shell_exec]
? local-script  unverifiable — local node script

✓ 1 passed  ! 1 warnings  ✗ 0 critical  ? 1 unverifiable

name: MCP Security
on: [pull_request, push]

permissions:
  contents: read
  pull-requests: write

jobs:
  strata:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: PThrower/strata-mcp-check@v1
        with:
          strata_api_key: ${{ secrets.STRATA_API_KEY }}
          fail_on: critical

pip install requests

import requests

response = requests.get(
    "https://usestrata.dev/api/v1/mcp/verify",
    params={"url": "github.com/owner/repo"},
    headers={"X-API-Key": "YOUR_KEY"}
)
data = response.json()
print(f"Risk: {data['risk_level']} | Score: {data['security_score']}")

import requests

servers = [
    "github.com/modelcontextprotocol/server-filesystem",
    "github.com/owner/unknown-server"
]

for server in servers:
    r = requests.get(
        "https://usestrata.dev/api/v1/mcp/verify",
        params={"url": server},
        headers={"X-API-Key": "YOUR_KEY"}
    )
    data = r.json()
    if data["risk_level"] in ["high", "critical"]:
        print(f"WARNING: {server} — {data['risk_level']}")

import requests

r = requests.get(
    "https://usestrata.dev/api/v1/x402/verify",
    params={"url": "https://api.example.com/premium"},
    headers={"X-API-Key": "YOUR_KEY"}
)
data = r.json()
if data["trusted"]:
    print(f"Safe to pay — score: {data['security_score']}")
else:
    print(f"BLOCKED — flags: {data['flags']}")

import requests
from datetime import datetime, timedelta, timezone

since = (datetime.now(timezone.utc) - timedelta(days=7)).isoformat()
r = requests.get(
    "https://usestrata.dev/api/v1/threats",
    params={"since": since, "severity": "critical"},
    headers={"X-API-Key": "YOUR_KEY"}
)
for event in r.json()["events"]:
    print(f"{event['severity'].upper()}: {event['detail']}")

import requests

r = requests.post(
    "https://usestrata.dev/api/v1/lineage",
    json={
        "source_server": "https://source-mcp.example.com",
        "dest_server": "https://dest-mcp.example.com",
        "session_id": "my-agent-run-001",
        "data_tags": ["internal"]
    },
    headers={"X-API-Key": "YOUR_KEY"}
)
print(r.json()["risk_level"])

import {
  Strata,
  StrataAuthError,
  StrataRateLimitError,
  StrataValidationError,
  StrataNetworkError,
} from '@strata-ai/sdk'

try {
  await strata.verify(url)
} catch (err) {
  if (err instanceof StrataRateLimitError) {
    console.log('Reset at', err.resetAt)
    console.log('Remaining', err.remaining)
  }
}