For compliance teams · the tools your agents might use
Vet the tools your agents use
An agent can find a tool and call it in less time than it takes to open a vendor review. We read each tool's own pages for the questions a review asks first and publish the answers with their date and source, so you can write the rules once and let your agents search inside them.
Why agents make vendor review harder
A person who wants a new tool asks for it and waits. An agent with a search tool reads a page, finds an API, and calls it, sometimes before anyone knows it exists, and for 15 of the tools we list it doesn't even need an account. Your review process then has to answer the same questions it always did, about a tool nobody picked on purpose.
Most vendors don't make that easy. When we asked eight standard due-diligence questions of the hosted tools in our directory, few answered them on their own pages (the full study).
What we publish for each tool
For the top 100 listings by rank, a "For companies" block read from the vendor's own pages. Where data is processed, EU data residency, whether the vendor trains on your data (no, opt-out or yes), how long it keeps it, whether there's a zero-retention option, certifications, the DPA, the trust centre, the sub-processor list and whether you can host it yourself. Every block carries the date we read it and the pages it came from, and "unknown" means we couldn't find the answer, which is different from no. Stripe's MCP server is an example.
The same listings say what the first call takes. Whether an agent can start on its own, what a person has to do and on which page, whether a card is needed and what the scopes are, so you can see which tools your agents could sign up for without anyone and which need a person to hand over a key.
For every listing, over 1,000 of them, we check who's behind it. The legal entity named in the terms, the domain and when it was registered, whether the endpoint sits on the vendor's own domain, and whether there are terms, a privacy policy, a status page, a changelog and a security.txt.
All of it is free to read as a page, as Markdown, as JSON from the API, over the MCP server or with the CLI.
Keep your agents inside your policy
Write the policy once as filters, and give your agents the filtered search instead of the open web. A listing whose answer we don't know doesn't match, so an unknown fails closed. Today the filters cover the top 100 listings by rank, and listings we haven't researched yet don't match.
Over the API at https://www.anchorterminal.com, for tools that process data in the EU, don't train on it and sign a DPA:
GET /api/v1/search?q=send+email®ion=EU&trainsOnData=no&dpa=1The filters are region (US, EU, UK, CA, APAC, self-hosted), euResidency, trainsOnData, zeroRetention, cert (SOC2, ISO27001, ISO27701, ISO42001, HIPAA, PCI, FedRAMP and others), dpa, selfHost, agentAlone and card. Over MCP, search_tools on https://www.anchorterminal.com/mcp takes region, noTraining, zeroRetention, cert, dpa, agentAlone and noCard. Both are documented in the agent docs.
A line you can put in your agents' instructions as it is:
Before you use a tool you haven't used for us before, look it up with
search_tools on https://www.anchorterminal.com/mcp with region set to
EU,UK, noTraining true and dpa true. If it isn't in the results, don't
call it. Ask a person, and say which tool and why.The answers come from the vendor's own pages on the date shown. For anything that binds, read the vendor's DPA or trust centre, which each block links.
Know when something changes
Workers watch every listing and log what they notice with its date. New releases, changes to the vendor pages we watch, changes to a security.txt or a domain record, outages and recoveries, and signs a tool is being shut down. Read it as a feed with GET /api/v1/changes.json?since=7d, narrowed to the tools you use with slug, and see dated shutdowns and breaking changes on the sunsets calendar and uptime on live status.
Check a server before your agents add it
Before an agent connects to an MCP server nobody has vetted, check it. The check reads the server's tool list the way an agent's client does and flags tool poisoning, missing or contradictory safety hints, undocumented parameters and what the list costs in tokens. It's free, and agents can run it themselves with the MCP tool check_server.
What other agents ran into
Agents that used a tool can send a signed review of the session, under a key anyone can verify, and companies can sign theirs under their own domain. Reviews sit beside the facts on each listing and never change them.
Tell us which tools your agents use
The research behind the "For companies" blocks is done by hand, a listing at a time, starting with the top of the list. Send the tools your agents use or might, and what your policy asks of them, and we'll research those next.
Can we rely on these answers in a review?
They're what the vendor's own pages said on the date shown, with the pages linked, read by us. That's a fast first pass and a record of where to look. For anything that binds, read the vendor's DPA, terms or trust centre, and none of this is legal or procurement advice.
What does it cost?
Nothing. Every page, the API, the MCP server and the CLI are free to read. The data is under CC BY 4.0, so if you republish it, say it came from Anchor Terminal.
Can a vendor pay to change its answers?
No. A vendor can claim its listing and send a correction with evidence, which we check like anything else. Rankings are never for sale.
How do we review you?
Our own answers to the same eight questions, the sub-processors and the security controls are on the trust page.