ooruby
A catalogue of AI agents and MCP servers that shows, for every listing, what a published set of checks found in its code, and what was not checked.
Our own product, not client work ooruby.com(opens in a new tab) Read 19 October 2026
The job
Anyone choosing an AI agent, or an MCP server (the connectors that let an AI assistant use other software), is asked to install code they have not read, often with access to their files and accounts. ooruby reads it first and publishes what it found, against a standard anyone can read, including what the checks do not cover.
What we built
- A catalogue of agents, MCP servers, apps and templates, each listing showing where the software came from and which version was read
- A fixed, published standard of 16 checks (rubric v1.0), an explainer for each check, and a plain list of what a clean result does not mean
- A check an AI agent can call before it installs anything: hand it a package name and it answers with the published findings
- Original research with its data published: an index of 823 MCP servers, and an audit of 200 apps made with an AI app builder
- Signed verification records (Ed25519, with published public keys), designed so anyone can check a result for themselves, and a public ledger to look them up
Where the AI is, and how it is kept honest
An absent finding is not a pass
A listing with no findings has not passed anything it was not checked for, so every result lists the checks that were not run, and an unexamined package says so in its first line. 1
Results that expire
A result is recorded against one version on one date, and it expires. A badge with no expiry is a weaker claim, not a stronger one. 1
Automation checked by hand
The standard was run by hand on 30 listings on 30 September 2026. Of the 35 automated notes on them, 5 were read as false and withdrawn, and the 138 of 330 cells that reading cannot settle are published as such. 2
What a clean result means
That the checks it ran found no problem. Not that there is none: software can change after it was read, and the terms say so in those words. 3
What it does not do yet
What it shows about the work we would do for you
Checks with their limits attached
A result that names the checks it did not run is the standard we hold an agent to: every action leaves a record, including what it refused to do.
The audit layerRead before you install
The same question ooruby asks of an MCP server is the one we ask before an agent touches your systems: what can it reach, and what has anyone actually checked?
Cleanup and securitySources
- 01 ooruby: the verification standard, “What we check, and what we do not” ooruby.com(opens in a new tab)
Weight: primary; the product’s own published page (our product) Re-checked: every 30 days Last read: 19 October 2026
- 02 ooruby: rubric v1.0, run by hand on 30 listings, 30 September 2026 ooruby.com(opens in a new tab)
Weight: primary; the product’s own review, with its method Re-checked: once a year Last read: 19 October 2026
- 03 ooruby: terms (last updated 11 October 2026) ooruby.com(opens in a new tab)
Weight: primary; the product’s own published page (our product) Re-checked: every 30 days Last read: 19 October 2026
- 04 ooruby: how much of the catalogue each kind of evidence covers ooruby.com(opens in a new tab)
Weight: primary; the product’s own published page (our product) Re-checked: every 30 days Last read: 19 October 2026
- 05 ooruby: the ooruby Index #1, 823 MCP servers, data as of 25 September 2026 ooruby.com(opens in a new tab)
Weight: primary; the product’s own study, with its data Re-checked: once a year Last read: 19 October 2026
- 06 ooruby: App Audit #1, 200 apps made with an AI app builder, data as of 30 September 2026 ooruby.com(opens in a new tab)
Weight: primary; the product’s own study, with its data Re-checked: once a year Last read: 19 October 2026
- 07 ooruby: home page (“None has been through the full rubric yet”, and what the badge does not cover) ooruby.com(opens in a new tab)
Weight: primary; the product’s own published page (our product) Re-checked: every 30 days Last read: 19 October 2026
- 08 ooruby: the public ledger of signed verification records ooruby.com(opens in a new tab)
Weight: primary; the product’s own published page (our product) Re-checked: every 30 days Last read: 19 October 2026
Checked 19 October 2026. Next scheduled check 18 November 2026. Numbers that move (leaderboards, live indices) are re-checked every 30 days; annual datasets and rules in force every six months; dated research once a year. If something here has gone stale before we got to it, tell us and we will correct it and say what changed.
One job, named. Tell us which.
If a job in your week needs the same care (answers with their sources, checks with their limits written down), that is where an engagement starts: one job, named before we quote.