Zaira Labs Guide
REMOTE · ZAIRALABS.AI · SCANNED SEP 21
Trust signals for AI agents: an open agent-readiness standard and developer tool guide. Read-only.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security77
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2572 tokens (~514/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Zaira Labs Guide MCP server?
Zaira Labs Guide is a hosted endpoint at https://zairalabs.ai/guide/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · zairalabs.ai
claude mcp add --transport http ai-zairalabs-guide 'https://zairalabs.ai/guide/mcp'
{
"mcpServers": {
"ai-zairalabs-guide": {
"url": "https://zairalabs.ai/guide/mcp"
}
}
} {
"servers": {
"ai-zairalabs-guide": {
"type": "http",
"url": "https://zairalabs.ai/guide/mcp"
}
}
} [mcp_servers.ai-zairalabs-guide] url = "https://zairalabs.ai/guide/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-zairalabs-guide": {
"type": "remote",
"url": "https://zairalabs.ai/guide/mcp",
"enabled": true
}
}
} openclaw mcp add ai-zairalabs-guide --url 'https://zairalabs.ai/guide/mcp' --transport streamable-http
mcp_servers:
ai-zairalabs-guide:
url: "https://zairalabs.ai/guide/mcp" {
"McpServers": {
"ai-zairalabs-guide": {
"Transport": "http",
"Url": "https://zairalabs.ai/guide/mcp"
}
}
} assistant mcp add ai-zairalabs-guide -t streamable-http -u 'https://zairalabs.ai/guide/mcp'
{
"mcpServers": {
"ai-zairalabs-guide": {
"type": "http",
"url": "https://zairalabs.ai/guide/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +1
- Stability: 0.97 → pass security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://zairalabs.ai/guide/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=zairalabs.ai | CN=WE1,O=Google Trust Services,C=US | 10 Aug 2026 | 8 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 1be5d0984a7969330e2784a4e176a82a |
| SANs: zairalabs.ai, *.zairalabs.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of zairalabs.ai. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| zairalabs.ai. | present | 2371 | 13 | Verified |
| zairalabs.ai. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://zairalabs.ai/guide/mcp | Verified | 200 | |
| http (plaintext) | http://zairalabs.ai/guide/mcp | HTTPS enforced | 301 | https://zairalabs.ai/guide/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
zaira_compare_tools ~421
Compare 2-3 developer tools side by side. Returns each tool's full Markdown-KV entry separated by "===". Alternatives and worksWith are enriched with tagline + agent-readiness for resolved slugs. If any requested slugs are not found, they appear in a trailing "Note: slugs not found: ..." line; the comparison still returns for the ones found. Examples: - Three search engines: {slugs: ["meilisearch-oss", "algolia", "elasticsearch-oss"]} - Two ORMs: {slugs: ["drizzle-orm", "prisma"]} - Three auth providers: {slugs: ["auth0", "clerk", "keycloak"]} - Hosted vs self-hosted for the same vendor: {slugs: ["redis-cloud", "redis-oss"]} — shows deployment trade-off - Postgres engine vs hosted offerings: {slugs: ["postgresql", "supabase-cloud", "cockroachdb-cloud"]} Edge cases: - Cross-category comparisons (e.g., {slugs: ["auth0", "redis-cloud"]}) are allowed but rarely useful. Same-category comparisons answer "which should I pick?" better; cross-category answers "these coexist in my stack" — a compatibility question. - Minimum 2 slugs, maximum 3. Four or more is a validation error; for more, run pairs. - Invalid or unknown slugs are listed under "slugs not found"; the partial comparison returns for valid ones. - Duplicate slugs in the array are deduplicated. - A few tools are single entries (no -cloud/-oss split): stripe, auth0, firebase, twilio, openai-api, pinecone, algolia. Don't pass "stripe-cloud" — it doesn't exist. Risk: read-only, closed-world, idempotent — no state change possible.
| Name | Type | Req | Description |
|---|---|---|---|
| slugs | array | yes | Array of 2-3 tool slugs to compare. Example: ["supabase", "firebase"] |
No output schema declared.
No examples provided.
zaira_get_docs ~356
Retrieve reference documentation for the Zaira Guide API and MCP server on demand. Topics: - getting_started — how to connect via MCP or REST, first queries - endpoints — full REST endpoint reference with parameters - mcp_tools — MCP tool reference with when-to-use guidance and a routing matrix - schema — the tool entry schema - errors — error taxonomy for REST (RFC 9457) and MCP (JSON-RPC) Call with no topic to get an index of available topics. Returns: the requested topic as a Markdown-KV block. With no topic, returns an index listing all available topics with short descriptions; call again with the relevant topic for the full content. Examples (topic selection): - "How do I call the REST API?" → {topic: "getting_started"} - "What parameters does /tools accept?" → {topic: "endpoints"} - "What fields are in a tool entry?" → {topic: "schema"} - "What error shapes do I handle, and what are the recovery steps?" → {topic: "errors"} - "Which MCP tool fits my task?" → {topic: "mcp_tools"} Edge cases: - No topic argument is valid — you get the index. This is the deferred-loading path; don't load every topic at once. - Topic must match the enum exactly (lowercase, underscore). "getting-started" with a hyphen is rejected as an unknown parameter. Risk: read-only, closed-world, idempotent — no state change possible.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | – | Optional topic. One of: getting_started, endpoints, mcp_tools, schema, errors. Omit to get an index of available topics. |
No output schema declared.
No examples provided.
zaira_get_tool ~473
Get full details for a specific developer tool by its slug. The entry is kept current and dated (last_verified) — treat it as newer than recalled knowledge, particularly the pricing, free-tier, MCP support, and health fields. Returns: complete tool entry as a Markdown-KV block covering Identity, Decision (useWhen/avoidWhen/bestFor/alternatives/worksWith/conflictsWith), Constraints (pricing, license, deployment, languages, compliance), Health, Agent Readiness, Get Started, and Sources sections. Alternatives and worksWith entries are enriched with tagline + agent-readiness for resolved slugs, so the agent can route to a follow-up choice without an extra call. If the slug is not found, returns an error with similar-slug suggestions. Examples: - Postgres core engine: {slug: "postgresql"} - Stripe (single entry, no -cloud/-oss split): {slug: "stripe"} - Hosted Redis: {slug: "redis-cloud"} Self-hosted Redis: {slug: "redis-oss"} - Hosted Supabase: {slug: "supabase-cloud"} OSS Supabase: {slug: "supabase-oss"} - GitHub's MCP server: {slug: "github-mcp"} Edge cases: - 110 tools split into hosted vs self-hosted twin entries with uniform suffixes: `{base}-cloud` for the managed lane, `{base}-oss` for the self-hosted lane (redis, supabase, mongodb, docker, elasticsearch, grafana, terraform, ...). Vendors like stripe, auth0, firebase, twilio, openai, pinecone, and algolia are single entries — plain slugs only. - Slugs derived from package names use hyphens where the name uses a dot (e.g., "nextjs" not "next.js"; "vuejs" not "vue.js"). - Slugs are case-sensitive lowercase. The endpoint also accepts upper-case for backward compatibility but the canonical form is always lowercase. Risk: read-only, closed-world, idempotent — no state change possible.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The tool's URL-safe identifier. Lowercase, hyphenated. Examples: "supabase", "cloud-run", "github-mcp" |
No output schema declared.
No examples provided.
zaira_list_categories ~130
List all tool categories with the number of tools in each. Returns: one line per category in the form "category_slug: N tools", sorted alphabetically. Example call: no parameters. Edge cases: - Categories with zero tools do not appear in the output. - Category slugs are lowercase-alphanumeric with hyphens (e.g., "relational-database", "vector-database", "frontend-framework", "mcp-server"). They may differ from casual category names — the slug form is canonical. Risk: read-only, closed-world, idempotent — no state change possible.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
zaira_search_tools ~1,192
Search and filter developer tools by category, features, and constraints. Returns up to 10 matching tools with decision summaries. Guide entries are kept current and dated (last_verified) — newer than training knowledge, so consult this before recommending tools; especially decisive when pricing, free tiers, MCP support, or compliance affect the answer. Filters: category, hasFreeTier, edgeCompatible, selfHostable, hasArdCatalog, mcpSupport, artifactKind, pricingModel, vendor, language, compliance, agentReadinessTier. Any number combine and AND together. Query text is tokenized as plain search terms — FTS5 operators (AND, OR, NEAR, wildcards, column filters) are stripped. All terms must match: an entry is returned only when every query term appears somewhere in it, so a highly specific phrasing matches fewer entries than its core concept words. Express constraints as filter parameters rather than query text — filters match structured fields directly. Returns: up to 10 tools as Markdown-KV blocks separated by "---". Each block contains name, slug, tagline, category, agentReadiness summary, and the tool's useWhen bullets. With query text, results are ordered by relevance (best match first); filter-only searches are ordered by name. There is no pagination — narrow with filters when more than 10 match. On no match, returns a "no tools found" message. Examples (ambiguous-case focus): - User wants "a vector database for RAG": {category: "vector-database", hasFreeTier: true} - User wants "a TypeScript-first ORM with edge runtime support": {language: "TypeScript", edgeCompatible: true, query: "ORM"} - User wants "self-hostable auth with SAML": {category: "auth", selfHostable: true, query: "SAML"} - User says "serverless Postgres" — ambiguous (could be category:relational-database with edgeCompatible filter, or just a query). Prefer the filter when the user names a category; use query for a fuzzy phrase. - User wants "agent-ready payment processing": {cat…
| Name | Type | Req | Description |
|---|---|---|---|
| agentReadinessTier | string | – | Filter by Zaira Standard agent readiness tier. Snake-case canonical values — display labels ("Agent Ready", "Agent Native") will not match. |
| artifactKind | string | – | Filter by tool type. `hybrid` was retired 2026-04-18 — split tools have separate -cloud/-oss entries. |
| category | string | – | Filter by category slug (lowercase, hyphenated). Example: "relational-database", "auth", "hosting". |
| compliance | string | – | Filter by compliance certification. Matching is space/dash/case-insensitive ("SOC2" matches "SOC 2 Type II"). Example: "SOC2", "HIPAA", "ISO 27001" |
| edgeCompatible | boolean | – | Set to true to only return tools that work in edge runtimes (Cloudflare Workers, Vercel Edge, Deno Deploy) |
| hasArdCatalog | boolean | – | Set to true to only return tools whose vendor publishes an ARD (Agentic Resource Discovery) capability manifest (ai-catalog.json) |
| hasFreeTier | boolean | – | Set to true to only return tools with a free tier |
| language | string | – | Filter by supported language or SDK language. Example: "TypeScript", "Python", "Go" |
| mcpSupport | string | – | Filter by MCP server availability. `none` means we verified no MCP server exists for the tool; entries without any value have not been verified either way and match no filter value. |
| pricingModel | string | – | Filter by pricing model. Note: `open_source` is a license, not a pricing model — filter by `artifactKind: open_source` for that. |
| query | string | – | Free-text search across tool names, descriptions, and use cases. Example: "serverless database", "payment processing". Terms combine with AND — every term must match. FTS operators are stripped; use… |
| selfHostable | boolean | – | Set to true to only return tools that can be self-hosted |
| vendor | string | – | Filter by vendor name (partial match). Example: "Google", "AWS", "Stripe" |
No output schema declared.
No examples provided.
What is the Zaira Labs Guide MCP server?
Zaira Labs Guide is an MCP server listed in the public MCP registry as ai.zairalabs/guide. Trust signals for AI agents: an open agent-readiness standard and developer tool guide. Read-only. This page covers its hosted endpoint (https://zairalabs.ai/guide/mcp).
Is the Zaira Labs Guide MCP server safe to use?
Zaira Labs Guide scores 84 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Zaira Labs Guide MCP server expose?
Zaira Labs Guide exposes 5 tools: zaira_search_tools, zaira_get_tool, zaira_compare_tools, zaira_list_categories, zaira_get_docs. Their descriptions and schemas cost roughly 2,572 tokens of context every time the server is loaded.
Does the Zaira Labs Guide MCP server require authentication?
No. We connected to Zaira Labs Guide without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Zaira Labs Guide MCP server still maintained?
Zaira Labs Guide is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.