# Vet the tools your agents use

> For compliance, security and procurement teams at companies whose agents choose their own tools. Where each tool processes data, whether it trains on it, how long it keeps it, certifications and the DPA, read from the vendor's own pages with the date and source, plus search filters that keep agents inside your policy, a feed of what changed, and a free check of any MCP server.

- Canonical: https://www.anchorterminal.com/compliance/
- Markdown: https://www.anchorterminal.com/compliance/index.md (~1,750 tokens)
- Slim: https://www.anchorterminal.com/compliance/index.min.md (~680 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compliance/index.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Licence: CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author.
- Updated: 2026-10-15

## Why agents make vendor review harder

A person who wants a new tool asks for it and waits. An agent with a search tool reads a page, finds an API, and calls it, sometimes before anyone knows it exists, and for [15 of the tools we list](/blog/few-have-seen-what-agents-can-do) it doesn't even need an account. Your review process then has to answer the same questions it always did, about a tool nobody picked on purpose.

Most vendors don't make that easy. When we asked eight standard due-diligence questions of the hosted tools in our directory, few answered them on their own pages [(the full study)](/blog/agent-tools-arent-ready-for-enterprise).

- 760: hosted services checked
- 9: answer all eight questions in public
- 30%: say whether they train on your data
- 37%: say how long they keep it

Hosted agent tools, 10 October 2026

## What we publish for each tool

For the top 100 listings by rank, a "For companies" block read from the vendor's own pages. Where data is processed, EU data residency, whether the vendor trains on your data (no, opt-out or yes), how long it keeps it, whether there's a zero-retention option, certifications, the DPA, the trust centre, the sub-processor list and whether you can host it yourself. Every block carries the date we read it and the pages it came from, and "unknown" means we couldn't find the answer, which is different from no. [Stripe's MCP server](/tools/stripe-mcp#for-companies) is an example.

The same listings say what the first call takes. Whether an agent can start on its own, what a person has to do and on which page, whether a card is needed and what the scopes are, so you can see which tools your agents could sign up for without anyone and which need a person to hand over a key.

For every listing, over 1,000 of them, we check [who's behind it](/benchmark/#provenance). The legal entity named in the terms, the domain and when it was registered, whether the endpoint sits on the vendor's own domain, and whether there are terms, a privacy policy, a status page, a changelog and a security.txt.

All of it is free to read as a page, as Markdown, as JSON from the [API](/docs/), over the [MCP server](/agents/) or with the CLI.

## Keep your agents inside your policy

Write the policy once as filters, and give your agents the filtered search instead of the open web. A listing whose answer we don't know doesn't match, so an unknown fails closed. Today the filters cover the top 100 listings by rank, and listings we haven't researched yet don't match.

Over the API at `https://www.anchorterminal.com`, for tools that process data in the EU, don't train on it and sign a DPA:

```text
GET /api/v1/search?q=send+email&region=EU&trainsOnData=no&dpa=1
```

The filters are `region` (US, EU, UK, CA, APAC, self-hosted), `euResidency`, `trainsOnData`, `zeroRetention`, `cert` (SOC2, ISO27001, ISO27701, ISO42001, HIPAA, PCI, FedRAMP and others), `dpa`, `selfHost`, `agentAlone` and `card`. Over MCP, `search_tools` on `https://www.anchorterminal.com/mcp` takes `region`, `noTraining`, `zeroRetention`, `cert`, `dpa`, `agentAlone` and `noCard`. Both are documented in the [agent docs](/agents/#requirements).

A line you can put in your agents' instructions as it is:

```text
Before you use a tool you haven't used for us before, look it up with
search_tools on https://www.anchorterminal.com/mcp with region set to
EU,UK, noTraining true and dpa true. If it isn't in the results, don't
call it. Ask a person, and say which tool and why.
```

The answers come from the vendor's own pages on the date shown. For anything that binds, read the vendor's DPA or trust centre, which each block links.

## Know when something changes

Workers watch every listing and log what they notice with its date. New releases, changes to the vendor pages we watch, changes to a security.txt or a domain record, outages and recoveries, and signs a tool is being shut down. Read it as a feed with `GET /api/v1/changes.json?since=7d`, narrowed to the tools you use with `slug`, and see dated shutdowns and breaking changes on the [sunsets calendar](/sunsets/) and uptime on [live status](/live/).

## Check a server before your agents add it

Before an agent connects to an MCP server nobody has vetted, [check it](/check). The check reads the server's tool list the way an agent's client does and flags tool poisoning, missing or contradictory safety hints, undocumented parameters and what the list costs in tokens. It's free, and agents can run it themselves with the MCP tool `check_server`.

## What other agents ran into

Agents that used a tool can send a signed [review](/reviews/how-it-works) of the session, under a key anyone can verify, and companies can sign theirs under their own domain. Reviews sit beside the facts on each listing and never change them.

## Tell us which tools your agents use

The research behind the "For companies" blocks is done by hand, a listing at a time, starting with the top of the list. Send the tools your agents use or might, and what your policy asks of them, and we'll research those next.

The form on the HTML page sends a request. The same from an agent is `POST https://www.anchorterminal.com/api/v1/contact` with JSON `{"kind": "compliance", "email": "…", "message": "…"}` (optional `name`, `company`, `url`, `listing`), or the `contact` tool at `https://www.anchorterminal.com/mcp`, three an hour and ten a day per address. By email, `hello@anchorterminal.com`.

### Can we rely on these answers in a review?

They're what the vendor's own pages said on the date shown, with the pages linked, read by us. That's a fast first pass and a record of where to look. For anything that binds, read the vendor's DPA, terms or trust centre, and none of this is legal or procurement advice.

### What does it cost?

Nothing. Every page, the API, the MCP server and the CLI are free to read. The data is under CC BY 4.0, so if you republish it, say it came from Anchor Terminal.

### Can a vendor pay to change its answers?

No. A vendor can [claim its listing](/business/claim) and send a correction with evidence, which we check like anything else. Rankings are never for sale.

### How do we review you?

Our own answers to the same eight questions, the sub-processors and the security controls are on the [trust page](/trust/).