generated: '2026-08-13' method: derived source: >- Derived on 2026-08-13 from https://www.pulsemcp.com/api/docs/v0.1, https://www.pulsemcp.com/api, https://www.pulsemcp.com/terms-of-service, the server.json manifests in https://github.com/pulsemcp/mcp-servers, and live probes of https://api.pulsemcp.com. Each row records the evidence it rests on. description: >- Cross-cutting standards conformance for PulseMCP. The short version: PulseMCP is deeply conformant to the Model Context Protocol family of specifications — it is literally the registry for them — and conformant to nothing else. There is no OAuth, no OIDC, no RFC 9457, no OpenAPI, no published certification or compliance programme, and no regulated-industry regime applies to a developer directory. standards: - id: mcp name: Model Context Protocol conforms: true evidence: >- 32 first-party MCP servers, every one shipping a server.json against https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json and declaring an stdio transport. Co-founder Tadas Antanavicius sits on the MCP Steering Committee. - id: mcp-generic-registry-api name: Generic MCP Registry API specification conforms: true evidence: >- The /api page states the PulseMCP Registry API "implements the Generic MCP Registry API specification" and links to https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/generic-registry-api.md. The documented paths (/servers, /servers/{name}/versions, /servers/{name}/versions/{version}) and the cursor/limit pagination match it. NOT independently verified against a response body — the API is key-gated. - id: mcp-generic-server-json name: Generic Server JSON specification conforms: true evidence: >- The API reference states responses conform to the Generic Server JSON specification with PulseMCP extensions carried in reverse-DNS _meta namespaces (com.pulsemcp/server, com.pulsemcp/server-version) rather than mixed into the server object. See data-model/pulsemcp-data-model.yml. - id: mcp-registry-publishing name: MCP Registry publication conforms: true evidence: >- https://github.com/pulsemcp/mcp-servers ships .github/workflows/publish-mcp-registry.yml and verify-mcp-server-publication.yml plus docs/MCP_REGISTRY_PUBLISHING.md — PulseMCP publishes its own servers into the upstream MCP registry, not just its own. - id: rfc3339 name: RFC 3339 timestamps conforms: true evidence: >- publishedAt, updatedAt, statusChangedAt and the updated_since query parameter are all documented as RFC 3339. - id: semver name: Semantic Versioning 2.0.0 conforms: true evidence: >- Server versions are semver; the `version` query parameter accepts a semver string or "latest"; the AIR changelog states the project "adheres to Semantic Versioning". - id: keepachangelog name: Keep a Changelog 1.1.0 conforms: true evidence: >- https://github.com/pulsemcp/air/blob/main/CHANGELOG.md declares the format explicitly and carries 20 dated released versions. Applies to the open source only — the Registry API has no changelog. - id: pagination name: Cursor pagination conforms: true evidence: >- Opaque metadata.nextCursor echoed back as the `cursor` parameter; limit 1-100, default 30; termination signalled by absence of nextCursor. - id: rate-limit-headers name: Rate-limit response headers conforms: partial evidence: >- Six documented headers (X-RateLimit-Limit-/Remaining- for minute, hour and day). NOT the RFC 9238 `RateLimit`/`RateLimit-Policy` form, and no reset or Retry-After header, so a throttled client is not told when to retry. - id: rfc9457 name: RFC 9457 Problem Details for HTTP APIs conforms: false evidence: >- Errors use a custom {error, code, details} envelope served as application/json, with no type URI and no title/detail/instance. Observed live on 2026-08-13. - id: openapi name: OpenAPI conforms: false evidence: >- No spec at any probed location on api.pulsemcp.com (/openapi.json, /openapi.yaml, /swagger.json, /v0.1/openapi.json, /api-docs, /docs, /redoc — all HTTP 404 with the API's JSON invalid_path body) nor anywhere in the github.com/pulsemcp organization. - id: idempotency name: Idempotency keys conforms: false evidence: >- Not documented. The API is read-only at v0.1 so every operation is inherently idempotent, but no Idempotency-Key mechanism exists for a future write surface. - id: oauth2 name: OAuth 2.0 conforms: false evidence: >- Authentication is a static X-API-Key header. /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource both return 404 on api.pulsemcp.com. Note the irony worth recording: PulseMCP SELLS OAuth metadata (RFC 9728 / RFC 8414 documents) about the servers it catalogues as a Premium enrichment, while implementing none itself. - id: oidc name: OpenID Connect conforms: false evidence: /.well-known/openid-configuration returns 404 on both hosts probed. - id: rfc9116 name: RFC 9116 security.txt conforms: false evidence: >- /.well-known/security.txt returns 404 on api.pulsemcp.com and (confirmed through a rendering fetch) on www.pulsemcp.com. See well-known/pulsemcp-well-known.yml. - id: rfc8594 name: RFC 8594 Sunset header conforms: false evidence: No Sunset or Deprecation header and no deprecation policy is published. - id: asyncapi name: AsyncAPI conforms: false evidence: >- Not applicable in practice — PulseMCP publishes no event, streaming or webhook surface at all. Nothing to describe. - id: json-api name: JSON:API conforms: false evidence: Plain JSON envelopes; no JSON:API document structure. - id: graphql name: GraphQL conforms: false evidence: No /graphql surface on any host. certifications: published: [] note: >- No SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP or GDPR/DPA documentation is published, and there is no trust centre. probe-security-programs.py returned vdp=none trust=none on 2026-08-13. No Compliance pointer is emitted in apis.yml as a result. regulatory_regimes: [] regulatory_note: >- None apply. PulseMCP is a developer directory and registry; it holds no financial, health, telecom or personal-data-heavy regulated workload.