Connector Lab: how a product looks to an agent.

Try these

• “Does Notion already have a connector for Claude? Who publishes it, and is it the official one?”
• “How ready is stripe.com for AI agents? Score it and tell me what an agent still cannot do.”
• “Here is the Petstore OpenAPI spec: https://petstore3.swagger.io/api/v3/openapi.json. Draft the connector an engineer should build from it.”

The tools

How find_connector decides first party

Anyone can publish a server to the official MCP Registry under a GitHub account, but only someone who controls a domain can publish under that domain’s namespace (com.notion, app.linear). So a server counts as first party only when all three are true:

1. It is published under a domain namespace the registry verified, not a GitHub or GitLab account.
2. That domain is the maker’s: the domain you pass, a domain from a published list of product makers, or a homepage that names the product.
3. Its connector URL or website lives on that same domain, and it is not named after another company’s product.

Makers also run endpoints they never list. When the registry has no first-party server, the tool sends one MCP initialize request to mcp.<domain>/mcp, mcp.<domain>/ and <domain>/mcp and reports how each answered: an open MCP server, a request for OAuth sign-in as the MCP authorization spec describes, or no answer. An endpoint on the maker’s own domain that answers as MCP counts as a first-party connector, with a note that it is not in the registry. Every match lists its publisher and the reason it was or was not counted as first party.

The eleven readiness checks

agent_readiness reads the company’s registered domain and its usual api., developers., docs. and mcp. subdomains. A pass earns the full points, a warning half, a fail nothing. Each failed or warned check comes with the evidence (the URLs read and what they returned) and one sentence on what an agent cannot do because of it.

• MCP endpoint or server card

  mcp_endpoint · 15 points

  Without it: Claude, ChatGPT and other MCP clients have no endpoint to connect to, so the product does not appear as a tool inside them.

• Public OpenAPI or GraphQL schema

  api_schema · 15 points

  Without it: An agent cannot learn the endpoints, parameters and types from a machine-readable file, so every call has to be written by hand from prose docs.

• OAuth authorization server metadata

  oauth_metadata · 12 points

  Without it: An agent cannot discover how to sign a user in, so it cannot get a user’s permission to act on their account without a pasted API key.

• Developer docs

  developer_docs · 10 points

  Without it: Neither an agent nor the developer wiring it up has a public reference for calling the product, so nothing can act on a user’s behalf.

• robots.txt rules for AI agents

  ai_agent_access · 10 points

  Without it: The AI agents that fetch pages for a user are blocked, so when someone asks an assistant about this product it cannot read the pages.

• llms.txt

  llms_txt · 10 points

  Without it: An agent has no index of the docs, so it crawls page by page and can miss the pages that matter.

• Listed in the official MCP Registry

  mcp_registry · 8 points

  Without it: MCP clients and connector directories that read the official MCP Registry cannot find a server from this company.

• Webhooks documented

  webhooks · 6 points

  Without it: An agent cannot be told when something changes, so it has to poll the API to notice new orders, tickets or payments.

• Sandbox or test keys documented

  sandbox · 6 points

  Without it: An agent cannot be tried safely against test data, so every trial run touches real customer records.

• Rate limit headers

  rate_limit_headers · 4 points

  Without it: An agent cannot see how close it is to the limit, so it finds out only when requests start failing.

• Status page

  status_page · 4 points

  Without it: An agent cannot tell an outage from its own mistake, so it retries or reports a bug when the product is simply down.

How the score works

The score is the points earned out of the points measured, scaled to 100. A check that could not be settled (a server that did not answer in time) is marked not measured and left out of both sides, so a slow site is not scored as a failing one. 80 and above reads as ready for agents, 60 to 79 as usable with work, 40 to 59 as hard for agents to use, and below 40 as close to invisible to agents.

What a blueprint holds

• Tools named for jobs, not endpoints. Operations are grouped by the resource they act on. Each group becomes a find_ or get_ tool for reads and a draft_ tool for writes, ranked by how central the resource is to the API, so customers and invoices come before helper resources.
• A read and write split. Every tool carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint as explicit values.
• A two-step confirm on every write. A draft tool validates the inputs and returns a preview and a one-time confirm_token; a single confirm_action tool carries the draft out exactly once, with an idempotency key, and the token expires after 15 minutes.
• The auth pattern chosen from the document’s security schemes: the user’s own OAuth sign-in where the API offers it, otherwise a per-user key collected behind the connector’s own sign-in, with the scopes the chosen tools need.
• The endpoints to leave out, each with its reason, in six groups:

• Destructive

  Deletes, cancels, voids, revokes, archives or resets. Left out of a first connector, or added later behind the confirm step once a reviewer has seen the rest work.

• Money movement

  Payments, payouts, transfers, refunds, charges, captures and disputes. A model should not move money, even behind a confirm.

• Credentials

  Sign in and out, sessions, keys, tokens and secrets, and any operation that takes a password or secret as an input. The connector handles sign-in itself and never hands a credential to a model.

• Access control

  Roles, permissions, members, invitations, SSO and SCIM. Changing who can see an account is a person’s decision.

• Bulk

  Batch, import and create-with-list operations that change many records in one call. An agent changes one record at a time, each behind a confirm.

• Deprecated

  Operations the document marks deprecated.

• Ten test prompts with the tool each should call, including the confirm step, a draft that is never confirmed, and requests for actions that were left out, which no tool should answer.
• A directory review checklist for the build.

Give the document’s URL, or a docs page or domain and the tool looks for the document: links on the page, the site’s llms.txt, a GitHub repository the docs link (such as github.com/stripe/openapi), and the usual paths such as /openapi.json. It reads OpenAPI 3.0, 3.1 and Swagger 2.0, in JSON or YAML, up to 20 MB, and never calls the API the document describes.

Data sources

• The official MCP Registry at registry.modelcontextprotocol.io, read through its public API. What a server says about itself there (description, auth, status) is the publisher’s own statement.
• The company’s public website: its homepage, robots.txt, llms.txt, /.well-known/ OAuth and MCP metadata, developer docs, status page, and public GitHub pages its docs point to.
• Three requests a browser would not send: one MCP initialize request to the usual MCP addresses, one GraphQL query that asks only for the schema’s name, and one unauthenticated request to the API host to read its rate limit headers. Nothing signs in and no key is ever sent.
• No model reads anything. Every verdict, score and blueprint comes from fixed rules, so the same public facts always give the same answer.

Limits

• Answers are reused before anything is read again: find_connector for 6 hours, agent_readiness and connector_blueprint for 24 hours. A cached answer says so.
• Fresh lookups are limited across all users: 1,200 find_connector, 400 agent_readiness and 400 connector_blueprint runs a day, and at most 1 fresh readiness check of the same domain every 10 minutes. Over a limit the tool says so and when to try again.
• Only public addresses. Private, loopback and internal network addresses are refused before any request is made, and every redirect is checked the same way.
• A readiness check reads a handful of pages, not the whole site. A check that fails says which pages were read, so a webhook guide two levels deep may be missed; the evidence shows exactly what was looked at.
• A blueprint is a design for an engineer to check against the API, not generated code. It reads what the document says; an API that behaves differently from its document will need the design adjusted.

For reviewers

No account, key or setup is needed. Add the connector URL above, then:

1. find_connector with product Notion returns the verdict first_party_connector_exists, with com.notion/mcp at https://mcp.notion.com/mcp marked first party and the community servers listed after it.
2. agent_readiness with domain stripe.com returns a score out of 100 with eleven checks, each with its evidence.
3. connector_blueprint with spec_url https://petstore3.swagger.io/api/v3/openapi.json returns job-named tools, a draft_ tool for every write, one confirm_action, the OAuth plan, the DELETE endpoints and the sign-in endpoints left out with reasons, and ten test prompts.
4. agent_readiness with domain localhost returns a specific error and makes no request.

Support and security

Questions, problems and security reports go to sarah@modernmustardseed.com. A machine-readable contact is at /.well-known/security.txt. How we handle data is in the privacy policy.