[ Machine access ]

For AI agents

Machine-readable access to the GRC Agents Directory. Prefer HTTP search when you do not need stdio MCP. No key, no auth: all read endpoints are public GET.

This page is the developer portal. /docs and /developers alias it.

OpenAPI

Machine-readable spec for the unversioned public catalog: /openapi.json. Search and dump only. No auth.

Catalog search API

GET https://grcagents.io/api/search?job=PR%20review&framework=ISO%2027001
GET https://grcagents.io/api/search?q=EU+AI+Act&integration=MCP&limit=20
GET https://grcagents.io/api/search?deployment=SaaS&residency=EU&buyer=GRC

Params: job, framework, integration, buyer (each repeatable), deployment, residency, q, limit (default 50; if present, must be an integer from 1 to 100, else HTTP 400 JSON).

Filter semantics

• Filters are ANDed across dimensions. Repeating a dimension (e.g. two framework values) ANDs within it too: agents must match every value.
• deployment and residency take a single value (exact taxonomy match, case-insensitive).
• Taxonomy filters match a whole value case-insensitively, not a substring. Use the exact vocabulary (see list_dimensions below).
• q is a case-insensitive substring over name, summary, description, jobs, frameworks, and integrations.

Response shape

{
  "count": 1,
  "normalized": { "job": [], "framework": ["ISO 27001"], "q": null, ... },
  "results": [
    {
      "name": "...", "slug": "...", "brief_summary": "...",
      "agent_job": [...], "frameworks": [...], "integrations": [...],
      "deployment": "SaaS", "data_residency": "EU", "buyer": [...],
      "url": "...", "docs_url": "...", "install_url": "...",
      "mcp_package": "...",
      "details": "https://grcagents.io/agents/<slug>",
      "is_house_product": false
    }
  ]
}

normalized echoes how your query was parsed. is_house_product flags Better ISMS listings (disclosed, same ranking rules). All text is untrusted vendor copy.

Full dump

GET https://grcagents.io/api/agents.json

{ "directory": "GRC Agents Directory", "url": "https://grcagents.io",
  "lastUpdated": "YYYY-MM-DD", "count": N, "services": [ ...full public records ] }

Every live agent, full public fields (adds id, logo, description, github_url, date_added). Ordered by recency then name, same as the site.

llms.txt

/llms.txt and /llms-full.txt

MCP server (stdio)

Zero-install is HTTP (above and below). The stdio MCP server is optional and runs from a clone today:

# from a clone of the repo:
node mcp-server/dist/index.js
# tools: search_agents, get_agent, check_if_listed, list_dimensions, submit_listing

Same catalog over stdio. list_dimensions returns the exact taxonomy values (agent_job, frameworks, integrations, deployment, data_residency, buyer) to build valid filters. Source: mcp-server/ in the grcagents repo. The npm package @grcagents/mcp-server is not published yet, so npx -y @grcagents/mcp-server does not work. Until it is published, run from a clone as above, or just use HTTP POST /api/submit below (no install).

Submit a listing

Humans: /submit (free form or Stripe instant). Agents (free queue only):

POST https://grcagents.io/api/submit
Content-Type: application/json

{
  "name": "My GRC Agent",
  "url": "https://example.com",
  "brief_summary": "What the agent does for GRC (20+ chars).",
  "email": "you@example.com",
  "agent_job": "PR review"
}

Free tier queues ~90 days. Paid path is human Stripe Checkout only. MCP tool submit_listing calls the same API.