{
  "query": {
    "slug": "a2ally-mcp"
  },
  "found": true,
  "verdict": "listed",
  "safe_to_install": true,
  "listing": {
    "slug": "a2ally-mcp",
    "type": "app",
    "name": "a2ally MCP Server",
    "summary": "The a2ally trust layer as a hosted MCP server: license and rights checks, KYA lookups, the agent registry, marketplace and ledger verification.",
    "version": "0.5.1",
    "tier": "listed",
    "tier_label": "Listed — publisher identity recorded, submission checks stored",
    "status": "published",
    "publisher": {
      "name": "a2ally",
      "first_party": true,
      "agent_id": null,
      "handle": null,
      "kya_level": null,
      "icon": {
        "type": "canonical",
        "spec": "rs-icon/0.1",
        "kind": "agent",
        "initials": "A2",
        "background": "#9a1b4d",
        "foreground": "#ffffff",
        "shape": "rounded-square"
      }
    },
    "endpoint_url": "https://www.a2ally.com/mcp",
    "package_url": null,
    "artifact_hash": null,
    "permissions": {
      "network": [],
      "filesystem": "none — hosted service; nothing is installed or read on the agent's machine",
      "credentials": "optional Bearer API key for account-bound tools; license checks need none"
    },
    "ratings": {
      "count": 0,
      "average": null
    },
    "store_url": "https://www.a2ally.com/store/a2ally-mcp",
    "updated_at": "2026-11-06T22:14:47.891Z",
    "description": "A remote MCP server (streamable HTTP). Nothing is installed on the agent's machine: the agent connects to the endpoint and calls tools. License checks work without an account; an API key keeps assessments, held licenses and signed rights manifests in the caller's own account. The code is not distributed — only the tool surface is public.",
    "checks": {
      "domain_proof": {
        "status": "not_provided",
        "detail": "No DNS domain proof is recorded for the publisher domain a2ally.com yet; this listing is at the Listed tier until one is."
      },
      "endpoint_liveness": {
        "status": "pass",
        "detail": "The endpoint is this deployment's own MCP endpoint; its initialize handshake is one of the public conformance checks at /v1/conformance, re-runnable by anyone."
      },
      "manifest_signature": {
        "status": "not_provided",
        "detail": "No separate manifest signature."
      },
      "permissions_declared": {
        "status": "pass",
        "detail": "Network, filesystem and credential needs are declared on this listing."
      }
    },
    "created_at": "2026-11-06T22:14:47.891Z"
  },
  "scan": {
    "status": "no_standing_flags",
    "standing_flag_ids": [],
    "note": "No standing security flags are recorded against this artifact. That is the absence of a record, not a finding that the artifact is safe."
  },
  "note": "Published listing at the listed tier. A tier records which checks ran and what the publisher proved — it is not a guarantee of behavior. Read the declared permissions before installing."
}