Know when your MCP
tools change.

# Fail-closed policy: UNRATED, NOT FOUND, errors and scores below 70 block.
# Requires curl 7.76+ and jq. Set MCP_URL to the intended server URL.
: "${MCP_URL:?Set MCP_URL first}"
if ! response=$(curl --fail-with-body --silent --show-error --get   --data-urlencode "url=$MCP_URL" "https://dominionobservatory.com/api/trust"); then
  echo "Blocked: registry request failed" >&2; exit 1
fi
if ! printf '%s' "$response" | jq -e '
  type == "object" and .found == true and .runtime_measured == true
  and (.error == null) and (.trust_score | type == "number")
  and (.trust_score >= 70 and .trust_score <= 100)' >/dev/null; then
  echo "Blocked: UNRATED, missing, invalid response or below policy" >&2; exit 1
fi
echo "Measured score meets policy; this does not guarantee safety."

This example fails closed. A fail-open policy may log a warning and continue after independent review, but must never label an unknown or failed lookup as a passing trust check.