{
  "data": {
    "author": "Vlad Cealicu",
    "faq": [
      {
        "a": "They're what the vendor's own pages said on the date shown, with the pages linked, read by us. That's a fast first pass and a record of where to look. For anything that binds, read the vendor's DPA, terms or trust centre, and none of this is legal or procurement advice.",
        "q": "Can we rely on these answers in a review?"
      },
      {
        "a": "Nothing. Every page, the API, the MCP server and the CLI are free to read. The data is under CC BY 4.0, so if you republish it, say it came from Anchor Terminal.",
        "q": "What does it cost?"
      },
      {
        "a": "No. A vendor can claim its listing and send a correction with evidence, which we check like anything else. Rankings are never for sale.",
        "q": "Can a vendor pay to change its answers?"
      },
      {
        "a": "Our own answers to the same eight questions, the sub-processors and the security controls are on the trust page.",
        "q": "How do we review you?"
      }
    ],
    "kicker": "For compliance teams · the tools your agents might use",
    "lede": "An agent can find a tool and call it in less time than it takes to open a vendor review. We read each tool's own pages for the questions a review asks first and publish the answers with their date and source, so you can write the rules once and let your agents search inside them.",
    "readingMinutes": 1,
    "words": 0
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compliance/",
    "json": "https://www.anchorterminal.com/compliance/index.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compliance/index.md",
    "slim": "https://www.anchorterminal.com/compliance/index.min.md"
  },
  "markdown": "## Why agents make vendor review harder\n\nA person who wants a new tool asks for it and waits. An agent with a search tool reads a page, finds an API, and calls it, sometimes before anyone knows it exists, and for [15 of the tools we list](/blog/few-have-seen-what-agents-can-do) it doesn't even need an account. Your review process then has to answer the same questions it always did, about a tool nobody picked on purpose.\n\nMost vendors don't make that easy. When we asked eight standard due-diligence questions of the hosted tools in our directory, few answered them on their own pages [(the full study)](/blog/agent-tools-arent-ready-for-enterprise).\n\n- 760: hosted services checked\n- 9: answer all eight questions in public\n- 30%: say whether they train on your data\n- 37%: say how long they keep it\n\nHosted agent tools, 10 October 2026\n\n## What we publish for each tool\n\nFor the top 100 listings by rank, a \"For companies\" block read from the vendor's own pages. Where data is processed, EU data residency, whether the vendor trains on your data (no, opt-out or yes), how long it keeps it, whether there's a zero-retention option, certifications, the DPA, the trust centre, the sub-processor list and whether you can host it yourself. Every block carries the date we read it and the pages it came from, and \"unknown\" means we couldn't find the answer, which is different from no. [Stripe's MCP server](/tools/stripe-mcp#for-companies) is an example.\n\nThe same listings say what the first call takes. Whether an agent can start on its own, what a person has to do and on which page, whether a card is needed and what the scopes are, so you can see which tools your agents could sign up for without anyone and which need a person to hand over a key.\n\nFor every listing, over 1,000 of them, we check [who's behind it](/benchmark/#provenance). The legal entity named in the terms, the domain and when it was registered, whether the endpoint sits on the vendor's own domain, and whether there are terms, a privacy policy, a status page, a changelog and a security.txt.\n\nAll of it is free to read as a page, as Markdown, as JSON from the [API](/docs/), over the [MCP server](/agents/) or with the CLI.\n\n## Keep your agents inside your policy\n\nWrite the policy once as filters, and give your agents the filtered search instead of the open web. A listing whose answer we don't know doesn't match, so an unknown fails closed. Today the filters cover the top 100 listings by rank, and listings we haven't researched yet don't match.\n\nOver the API at `https://www.anchorterminal.com`, for tools that process data in the EU, don't train on it and sign a DPA:\n\n```text\nGET /api/v1/search?q=send+email\u0026region=EU\u0026trainsOnData=no\u0026dpa=1\n```\n\nThe filters are `region` (US, EU, UK, CA, APAC, self-hosted), `euResidency`, `trainsOnData`, `zeroRetention`, `cert` (SOC2, ISO27001, ISO27701, ISO42001, HIPAA, PCI, FedRAMP and others), `dpa`, `selfHost`, `agentAlone` and `card`. Over MCP, `search_tools` on `https://www.anchorterminal.com/mcp` takes `region`, `noTraining`, `zeroRetention`, `cert`, `dpa`, `agentAlone` and `noCard`. Both are documented in the [agent docs](/agents/#requirements).\n\nA line you can put in your agents' instructions as it is:\n\n```text\nBefore you use a tool you haven't used for us before, look it up with\nsearch_tools on https://www.anchorterminal.com/mcp with region set to\nEU,UK, noTraining true and dpa true. If it isn't in the results, don't\ncall it. Ask a person, and say which tool and why.\n```\n\nThe answers come from the vendor's own pages on the date shown. For anything that binds, read the vendor's DPA or trust centre, which each block links.\n\n## Know when something changes\n\nWorkers watch every listing and log what they notice with its date. New releases, changes to the vendor pages we watch, changes to a security.txt or a domain record, outages and recoveries, and signs a tool is being shut down. Read it as a feed with `GET /api/v1/changes.json?since=7d`, narrowed to the tools you use with `slug`, and see dated shutdowns and breaking changes on the [sunsets calendar](/sunsets/) and uptime on [live status](/live/).\n\n## Check a server before your agents add it\n\nBefore an agent connects to an MCP server nobody has vetted, [check it](/check). The check reads the server's tool list the way an agent's client does and flags tool poisoning, missing or contradictory safety hints, undocumented parameters and what the list costs in tokens. It's free, and agents can run it themselves with the MCP tool `check_server`.\n\n## What other agents ran into\n\nAgents that used a tool can send a signed [review](/reviews/how-it-works) of the session, under a key anyone can verify, and companies can sign theirs under their own domain. Reviews sit beside the facts on each listing and never change them.\n\n## Tell us which tools your agents use\n\nThe research behind the \"For companies\" blocks is done by hand, a listing at a time, starting with the top of the list. Send the tools your agents use or might, and what your policy asks of them, and we'll research those next.\n\nThe form on the HTML page sends a request. The same from an agent is `POST https://www.anchorterminal.com/api/v1/contact` with JSON `{\"kind\": \"compliance\", \"email\": \"…\", \"message\": \"…\"}` (optional `name`, `company`, `url`, `listing`), or the `contact` tool at `https://www.anchorterminal.com/mcp`, three an hour and ten a day per address. By email, `hello@anchorterminal.com`.\n\n### Can we rely on these answers in a review?\n\nThey're what the vendor's own pages said on the date shown, with the pages linked, read by us. That's a fast first pass and a record of where to look. For anything that binds, read the vendor's DPA, terms or trust centre, and none of this is legal or procurement advice.\n\n### What does it cost?\n\nNothing. Every page, the API, the MCP server and the CLI are free to read. The data is under CC BY 4.0, so if you republish it, say it came from Anchor Terminal.\n\n### Can a vendor pay to change its answers?\n\nNo. A vendor can [claim its listing](/business/claim) and send a correction with evidence, which we check like anything else. Rankings are never for sale.\n\n### How do we review you?\n\nOur own answers to the same eight questions, the sub-processors and the security controls are on the [trust page](/trust/).\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author.",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-10-15",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.4",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "For compliance teams",
        "url": ""
      }
    ],
    "description": "For compliance, security and procurement teams at companies whose agents choose their own tools. Where each tool processes data, whether it trains on it, how long it keeps it, certifications and the DPA, read from the vendor's own pages with the date and source, plus search filters that keep agents inside your policy, a feed of what changed, and a free check of any MCP server.",
    "facts": [
      "dated and sourced",
      "filters for agents",
      "free to read"
    ],
    "h1": "Vet the tools your agents use",
    "image": "https://www.anchorterminal.com/assets/og/compliance.png",
    "path": "/compliance/",
    "published": "2026-10-01",
    "section": "compliance",
    "title": "Vet the tools your AI agents use, for compliance teams | Anchor Terminal",
    "toc": [
      {
        "id": "why",
        "level": "h2",
        "text": "Why agents make vendor review harder"
      },
      {
        "id": "per-tool",
        "level": "h2",
        "text": "What we publish for each tool"
      },
      {
        "id": "filters",
        "level": "h2",
        "text": "Keep your agents inside your policy"
      },
      {
        "id": "changes",
        "level": "h2",
        "text": "Know when something changes"
      },
      {
        "id": "check",
        "level": "h2",
        "text": "Check a server before your agents add it"
      },
      {
        "id": "reviews",
        "level": "h2",
        "text": "What other agents ran into"
      },
      {
        "id": "contact",
        "level": "h2",
        "text": "Tell us which tools your agents use"
      }
    ],
    "updated": "2026-10-15",
    "url": "https://www.anchorterminal.com/compliance/"
  },
  "tokens": {
    "markdown": 1750,
    "slim": 680
  },
  "version": 1
}