About Anomity Catalog

Anomity Catalog is a public reference for AI tools, MCP servers, IDE extensions, plugins, skills, and WebMCP tools that increasingly run inside enterprise environments. It exists so security teams, engineers, and procurement reviewers have a shared, citable description of what each piece of software actually does and where its risks come from.

What we cover

• MCP servers — Model Context Protocol servers that AI agents launch on the user's machine.
• AI tools — CLI agents, desktop apps, IDE-native AI, and autonomous agents.
• IDE extensions — AI-enabled IDE extensions for VS Code, Cursor, JetBrains, and others.
• Plugins — bundles of skills and integrations that ship for AI tools.
• Skills — discoverable AI behaviors that adjust how an agent works.
• WebMCP tools — pages and browser tooling that expose agent-callable tools inside the browser, where the agent acts in a session that is already signed in.

How the risk score is computed

The risk score is a pure function of three signals. No machine-learning model, no opaque heuristics — if a number on a page surprises you, you can trace it line by line.

score = 50 (neutral)
        + trustAdjustment   (official -40, community -10, unknown +20)
        + capabilitySum     (each HIGH_RISK_CAPABILITY +10, capped at +30)
        + dangerousComboSum (critical +25, high +15, medium +5)
clamp [0, 100]
band  = 0–29 low | 30–59 medium | 60–79 high | 80–100 critical

Trust

Trust reflects who publishes the software. Official entries are published by a vendor with an established responsibility chain. Community entries are popular, established third-party projects. Unknown entries are everything else — not necessarily malicious, but unverified.

High-risk capabilities

Some capabilities (shell execution, filesystem writes, credentials access, inbound network) carry enough power that one is enough to require scrutiny on an unknown publisher. The contribution is capped at +30 so a tool with many declared capabilities doesn't dominate the score on quantity alone.

Dangerous combinations

What matters more than any single capability is the combination. Shell execution + outbound network is data exfiltration potential. Filesystem write + credentials access is a persistence-and-theft chain. Each matched combination contributes weight by severity.

Where the data comes from

The MCP, capability, and AI-tool data is synced from the curated registries inside Anomity's main platform repository — the same registries the platform uses to classify what it discovers on managed endpoints. Extension, plugin, and skill entries are hand-curated in this catalog.

Last data sync: 2026-09-02 · 22 MCPs · 144 AI tools.

Analytics and cookies

The catalog sets no cookies of its own and has no accounts, no logins, and no sessions — Set-Cookie is stripped from every response. HTML pages do load two third-party analytics tags, Google Tag Manager and Microsoft Clarity, which set first-party cookies in your browser and record aggregate usage and session replays so we can see which risk profiles people actually read.

The machine-readable surface does not load them: /api/*, the Markdown twins, llms.txt, the feed, and the /.well-known/ documents are served without any analytics or cookies at all. An agent reading this catalog is not tracked.

What this catalog is not

• It is not a blocklist or a vendor-quality verdict. The score is a starting point, not a recommendation.
• It does not report telemetry from any specific organization. v1 carries no cross-customer prevalence data.
• It does not run any AI model. Every page is a pure transform over committed data.

Programmatic access

The same data backs a small public JSON API. No authentication, no cookies, no analytics, CORS open to any origin.

• GET /api/categories — kinds + counts
• GET /api/entries?kind=&q=&page=&pageSize= — paginated search
• GET /api/entries/:kind/:slug — single entry

Described formally by /openapi.json (OpenAPI 3.1).

For AI agents

This catalog is written to be read by software as much as by people. Everything below is generated from the same data as the HTML — there is no separate agent copy to drift out of date.

• Markdown twins — append .md to any entry or category URL (for example /mcp.md), or send Accept: text/markdown. Same facts, a fraction of the tokens.
• /llms.txt — the llmstxt.org index of the catalog.
• /llms-full.txt — every entry with its description, sized to drop into a context window.
• /feed.json — JSON Feed 1.1 of recently updated entries.
• /.well-known/api-catalog — RFC 9727 linkset pointing at all of the above.
• /.well-known/agent-skills/index.json — an agent skill that teaches a model to query the catalog and read a score correctly.

Crawlers are welcome. robots.txt explicitly allows the AI crawlers that identify themselves, and publishes a Content Signals Policy of search=yes, ai-input=yes, ai-train=yes. A risk score nobody can cite is a risk score nobody acts on.