Agents Allowed

Working Security A

io.agentsallowed/lookupv1.0.0 Domain verified

Check if a website lets AI agents browse, shop, book or log in, before acting.

Browser Automation

Watch Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-09T18:49:39.444293Z",
      "publishedAt": "2026-11-09T18:49:39.444293Z",
      "statusChangedAt": "2026-11-09T18:49:39.444293Z"
    }
  },
  "server": {
    "name": "io.agentsallowed/lookup",
    "icons": [
      {
        "src": "https://agentsallowed.io/favicon.svg",
        "sizes": [
          "any"
        ],
        "mimeType": "image/svg+xml"
      }
    ],
    "title": "Agents Allowed",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://agentsallowed.io/mcp",
        "type": "streamable-http"
      }
    ],
    "version": "1.0.0",
    "websiteUrl": "https://agentsallowed.io/developers/",
    "description": "Check if a website lets AI agents browse, shop, book or log in, before acting."
  }
}

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://agentsallowed.io/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

check_domain Read-only

Before acting on a website for a user, check whether it lets AI agents browse, shop, book or log in, and whether there's an official agent route (UCP, ACP, MCP, Visa TAP, A2A, partner apps). Returns status (open|partial|announced|none, or unknown if we have no verified record), recommended_action (a suggestion based on public sources, not permission; the website's own terms always take priority), per-action allowances, routes, dated sources. Read-only.

domainstring, required

Domain or URL, e.g. delta.com or https://www.delta.com/flights

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Run in a terminal

claude mcp add --transport http lookup https://agentsallowed.io/mcp

Tools (4)

check_domain

read-only

Argument	Type	Description
domain*	string	Domain or URL, e.g. delta.com or https://www.delta.com/flights

Input schema (JSON)

{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain or URL, e.g. delta.com or https://www.delta.com/flights"
    }
  },
  "additionalProperties": false
}

check_domains

Batch version of check_domain for up to 50 domains or URLs. Results are returned in input order. Read-only.

read-only

Argument	Type	Description
domains*	array

Input schema (JSON)

{
  "type": "object",
  "required": [
    "domains"
  ],
  "properties": {
    "domains": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 50,
      "minItems": 1
    }
  },
  "additionalProperties": false
}

report_block

Deprecated alias kept for older clients. Same as submit_update with type report_block (or report_works when result is works / official_route_found). Goes to human review; nothing auto-publishes.

Argument	Type	Description
agent	string
action*	string
domain*	string
result*	string
details	string
http_status	integer
observed_at	string
evidence_url	string

Input schema (JSON)

{
  "type": "object",
  "required": [
    "domain",
    "action",
    "result"
  ],
  "properties": {
    "agent": {
      "type": "string",
      "maxLength": 80
    },
    "action": {
      "enum": [
        "browse",
        "shop",
        "book",
        "login"
      ],
      "type": "string"
    },
    "domain": {
      "type": "string"
    },
    "result": {
      "enum": [
        "blocked",
        "human_check",
        "account_suspended",
        "works",
        "official_route_found"
      ],
      "type": "string"
    },
    "details": {
      "type": "string",
      "maxLength": 2000
    },
    "http_status": {
      "type": "integer"
    },
    "observed_at": {
      "type": "string",
      "format": "date-time"
    },
    "evidence_url": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

submit_update

Suggest a change to the database: add a brand (add_brand), correct a listing (correct_listing), report that an agent was stopped on a site (report_block), or report that a task now works (report_works). Every submission goes to a human review queue; nothing is published automatically, and a listing only changes once it is verified from a brand statement or official docs, reputable reporting, or our own documented test. Do not include personal data about the user.

Argument	Type	Description
type*	string
agent	string	Agent product, e.g. Meta Muse, ChatGPT agent, Claude, Grok.
field	string	Required for correct_listing.
action	string	Required for report_block / report_works.
domain*	string	Domain or URL the update is about.
result	string
details	string	Required for add_brand and correct_listing.
brand_name	string	Required for add_brand.
source_url	string	https link to a brand statement, official doc or article.
http_status	integer
observed_at	string
evidence_url	string	https link to a screenshot or log of what happened.
submitter_role	string
proposed_status	string	open, partial, announced or none.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "type",
    "domain"
  ],
  "properties": {
    "type": {
      "enum": [
        "add_brand",
        "correct_listing",
        "report_block",
        "report_works"
      ],
      "type": "string"
    },
    "agent": {
      "type": "string",
      "maxLength": 80,
      "description": "Agent product, e.g. Meta Muse, ChatGPT agent, Claude, Grok."
    },
    "field": {
      "enum": [
        "status",
        "allowed_actions",
        "official_routes",
        "summary",
        "sources",
        "domain_or_name",
        "other"
      ],
      "type": "string",
      "description": "Required for correct_listing."
    },
    "action": {
      "enum": [
        "browse",
        "shop",
        "book",
        "login"
      ],
      "type": "string",
      "description": "Required for report_block / report_works."
    },
    "domain": {
      "type": "string",
      "description": "Domain or URL the update is about."
    },
    "result": {
      "enum": [
        "blocked",
        "human_check",
        "account_suspended",
        "works",
        "official_route_found"
      ],
      "type": "string"
    },
    "details": {
      "type": "string",
      "maxLength": 2000,
      "description": "Required for add_brand and correct_listing."
    },
    "brand_name": {
      "type": "string",
      "maxLength": 120,
      "description": "Required for add_brand."
    },
    "source_url": {
      "type": "string",
      "description": "https link to a brand statement, official doc or article."
    },
    "http_status": {
      "type": "integer"
    },
    "observed_at": {
      "type": "string",
      "format": "date-time"
    },
    "evidence_url": {
      "type": "string",
      "description": "https link to a screenshot or log of what happened."
    },
    "submitter_role": {
      "enum": [
        "user",
        "agent",
        "brand",
        "journalist",
        "other"
      ],
      "type": "string"
    },
    "proposed_status": {
      "enum": [
        "none",
        "announced",
        "partial",
        "open"
      ],
      "type": "string",
      "description": "open, partial, announced or none."
    }
  },
  "additionalProperties": false
}

Security checkA100/100

We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 9, 2026.

Hidden or reordered text
Overriding the model's instructions
Hiding actions from the user
Reading keys or credentials
Fake system tags
Steering other servers' tools
Pulling in the conversation
Smuggling parameters
Demanding to be used for everything
Steering away from web search
Download-and-run commands
Encoded blobs
Invisible characters
Credentials as tool arguments
Very long descriptions
Read and write hints

How the security check works