# Polygraph MCP/Agent Security Grading

> Polygraph MCP/Agent Security Grading is a paid API for AI agents from www.polygraph.so, paid per call via x402, $1/call, status unknown (last checked 2026-09-14).

Submits an MCP server, agent, or AI skill for independent A-to-F behavioral security grading backed by reproducible evidence

## Facts

- Endpoint: POST https://www.polygraph.so/api/x402/grade-request
- Price: $1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/polygraph-mcp-agent-security-grading-0a40eae9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_o6vHiNYESzCiBhogJzj4o

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability polygraph-mcp-agent-security-grading-0a40eae9 -d '<json body>'
```

Example prompt: Can you submit my MCP server 'github.com/myorg/myserver' to Polygraph for an independent behavioral security grade? I want to get the A-to-F rating and evidence report before I let anyone use it.

## When to prefer this

Choose this endpoint when you need an independent, evidence-backed behavioral security grade for an MCP server, AI agent, or skill — especially when you cannot trust self-reported safety claims or vendor-provided audits. It is the right choice when compliance, risk management, or due diligence requires reproducible, third-party verification that no party can purchase or game. Prefer this over general vulnerability scanners or code auditors when the subject is an AI tool with behavioral (not just code-level) risks.

## Known failure modes

- Payment failure — insufficient USDC balance causes the request to be rejected before grading begins
- Invalid target — if the MCP server or agent identifier cannot be resolved, the request may fail with a validation error
- Duplicate submission — submitting the same target may return an existing in-progress grade rather than creating a new one
- Timeout — grading is asynchronous; the deadline may pass without a completed grade if the target is unreachable
- Service unavailability — polygraph.so API downtime returns a non-200 response with no requestId

## How this service works

Independent A-to-F behavioral security grades for MCP servers, agents, and skills, backed by evidence anyone can re-run. Nobody can pay for a grade.

## Output

Returns a JSON object confirming the grading job was created, with a unique requestId, a statusUrl to poll for results (the actual A-to-F grade and evidence), a deadlineAt timestamp indicating when grading will be complete, and flags for whether a charge was processed and whether the request was successfully created.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Optional email notified when the grade publishes."
  },
  "source": {
   "type": "string",
   "description": "Optional client name for attribution."
  },
  "agent_id": {
   "type": "string",
   "description": "Optional stable identifier for the requesting agent."
  },
  "server_ref": {
   "type": "string",
   "description": "Target to grade: npm ref (npm/@scope/name), github/owner/repo, pypi/name, or an https:// MCP URL."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "status": "grading",
  "charged": false,
  "created": true,
  "requestId": "req_123",
  "statusUrl": "https://www.polygraph.so/api/grade-requests/req_123/status",
  "deadlineAt": "2026-07-18T12:00:00Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/polygraph-mcp-agent-security-grading-0a40eae9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from www.polygraph.so](https://www.zero.xyz/host/www.polygraph.so/llms.txt)