An open, reproducible trust layer for AI artifacts — skills, MCP servers, agents, and plugins. Assay inspects code, runs sandboxed behavioral audits, and generates verifiable reports. Help us build th
An open, reproducible framework for evaluating AI artifacts skills · MCP servers · agents · plugins
Every registry that distributes AI artifacts answers "where did this come from?" None answers "what does it actually do?" as a published, auditable signal.
Assay answers the second question. It reads what is inside an artifact, and optionally runs it in a sandbox with a real model and judges what it did — then publishes a report that somebody who does not trust you can check.
- Why · Install · Quickstart - What you point it at · Reading the output - Running the artifact · In CI · Signing and verifying - How it works · Writing a check · Library use - What Assay does not claim
The gap is not an oversight. The official MCP Registry states in writing that consumers should "assume minimal-to-no moderation," and that it will not remove "low-quality or buggy servers" or "servers with security vulnerabilities." It relies instead on "upstream package registries (like NPM, PyPI, and Docker) or downstream subregistries."
Meanwhile every trust layer the industry does rely on has a dated counterexample:
Layer Counterexample ------------------- --------------------------------------------------------------------------------------------------------------------------------------------------------- Provenance postmark-mcp shipped 15 clean versions, then v1.0.16 added one line BCC'ing every email to an attacker. 1,643 downloads before removal.[^postmark] Reputation The SmartLoader campaign built five fake GitHub accounts cross-forking each other to manufacture a community around a trojan
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/metahub-ai--assay.html)
Give the agent "this" and he gets a real PC.
slxca/opencontextA Model Context Protocol server for persistent project-specific AI agent context.
azimov777/casefileThe task tracker your AI agents keep for each other: every task carries a case file, so the next agent picks up where the last one stopped. MCP server + live board. Self-hosted, one-line install.
bimal1023/AI-native-engineerTracking my journey into AI engineering, one module at a time. Fundamentals to agents, with hands-on projects. Open to all.
wahyunuriman999/Muse-Skill-HubOpen-source, LLM-agnostic capability runtime for AI agents — 97 skills as typed, permission-enforced MCP tools. Final certification: 23/23 gates PASS.
dontpayfull/AInotateAnnotated screenshots for AI agents: Skitch-style arrows, numbered steps, boxes, labels, solid redaction
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.