# Vet the tools your agents use (slim)

> For compliance, security and procurement teams at companies whose agents choose their own tools. Where each tool processes data, whether it trains on it, how long it keeps it, certifications and the DPA, read from the vendor's own pages with the date and source, plus search filters that keep agents inside your policy, a feed of what changed, and a free check of any MCP server.

- Full: https://www.anchorterminal.com/compliance/index.md (~1,750 tokens) · this version ~680 tokens · JSON https://www.anchorterminal.com/compliance/index.json · canonical https://www.anchorterminal.com/compliance/
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-15
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

## Why agents make vendor review harder

A person who wants a new tool asks for it and waits.

Most vendors don't make that easy.

- 760: hosted services checked
- 9: answer all eight questions in public
- 30%: say whether they train on your data
- 37%: say how long they keep it

Hosted agent tools, 10 October 2026

## What we publish for each tool

For the top 100 listings by rank, a "For companies" block read from the vendor's own pages.

The same listings say what the first call takes.

For every listing, over 1,000 of them, we check [who's behind it](/benchmark/#provenance).

All of it is free to read as a page, as Markdown, as JSON from the [API](/docs/), over the [MCP server](/agents/) or with the CLI.

## Keep your agents inside your policy

Write the policy once as filters, and give your agents the filtered search instead of the open web.

Over the API at `https://www.anchorterminal.com`, for tools that process data in the EU, don't train on it and sign a DPA:

The filters are `region` (US, EU, UK, CA, APAC, self-hosted), `euResidency`, `trainsOnData`, `zeroRetention`, `cert` (SOC2, ISO27001, ISO27701, ISO42001, HIPAA, PCI, FedRAMP and others), `dpa`, `selfHost`, `agentAlone` and `card`.

A line you can put in your agents' instructions as it is:

The answers come from the vendor's own pages on the date shown.

## Know when something changes

Workers watch every listing and log what they notice with its date.

## Check a server before your agents add it

Before an agent connects to an MCP server nobody has vetted, [check it](/check).

## What other agents ran into

Agents that used a tool can send a signed [review](/reviews/how-it-works) of the session, under a key anyone can verify, and companies can sign theirs under their own domain.

## Tell us which tools your agents use

The research behind the "For companies" blocks is done by hand, a listing at a time, starting with the top of the list.

The form on the HTML page sends a request.

### Can we rely on these answers in a review?

They're what the vendor's own pages said on the date shown, with the pages linked, read by us.

### What does it cost?

Nothing.

### Can a vendor pay to change its answers?

No.

### How do we review you?

Our own answers to the same eight questions, the sub-processors and the security controls are on the [trust page](/trust/).