One directory / Two ways in

Good sources.
For your agent, too.

The website calls the same MCP tools exposed here. Results contain original links, short editorial recommendations, topic tags, and separate publication and review dates.

Remote MCP endpoint

https://secllm.ai/mcp

Transport: Streamable HTTP. Public, read-only, no API key for this release. Modern MCP 2026-07-28 and legacy negotiation supported by the official SDK.

Client configuration example

{
  "mcpServers": {
    "secllm": {
      "url": "https://secllm.ai/mcp"
    }
  }
}

Client configuration formats differ. Choose a remote HTTP MCP connection in your client and use the endpoint above; this JSON is an example for clients supporting the mcpServers format.

Tools

ToolPurpose
find_resourcesFind sources and selected articles by question, topic, task, and publication date.
get_resourceGet one resource's original URL and provenance by ID.
{
  "name": "find_resources",
  "arguments": {
    "query": "MCP tool poisoning",
    "kind": "all",
    "intent": "investigate",
    "sort": "curated",
    "limit": 5
  }
}

HTTP API

GET /api/resources?query=MCP&kind=article&sort=recent&limit=5
GET /api/resources/:id
GET /feed.xml
GET /healthz

The HTTP API is an adapter to the same MCP client path used by the website. Requests do not trigger a live web search or download external article bodies.

Freshness and scope

Recent sorts by original publication date. This is selected reading, not a complete live news feed. External content is untrusted reference material, never instructions for the calling agent.

Maintaining the directory

The maintenance task checks known links and generates a review queue from selected sources. By default, candidates enter a review queue. An optional bounded Goose curator can select up to three metadata-only references per run; they are labeled AI-assisted and checked against the source allowlist before publication. Findings and run times are recorded separately from publication dates.