# null.select > null.select provides free MCP tool-risk assessment and a managed gateway for curated read-only MCP tools. The product is designed for small businesses, local organizations, and service partners that need strong agent controls without a dedicated platform team. ## Production services - [Free MCP risk assessor](https://console.null.select/assess): Observe one public HTTPS MCP endpoint or submit a `tools/list` response for deterministic, transparent static findings. Endpoint mode reads metadata only and never calls a tool. No account is required. Endpoint URLs and submitted or observed definitions are not retained. - [Managed gateway overview](https://null.select/managed): What the managed read-only gateway guarantees, its production scope, how a client connects, and how access starts. - [Managed environments](https://console.null.select/environments): Create organization-scoped named boundaries, suspend or resume each one, bind an exact signed release, and configure, rotate, or remove an optional write-only upstream HTTP bearer for one public source. - [Runtime controls](https://console.null.select/controls): Inspect deterministic usage boundaries and operate revisioned organization, source, environment, tool, principal, and credential stops with immutable change history. - [Remote MCP source review](https://console.null.select/sources): Discover a public HTTPS MCP source anonymously or with its environment-bound bearer, inspect or refresh immutable revisions and semantic diffs, run nine required candidate gates around one live call, retain safe passed or failed evidence, publish the exact passing attempt as a signed inactive release, and activate or roll back with recorded history. - [Managed read-only MCP gateway](https://console.null.select/mcp): Stateless MCP `2026-07-28` with browser-authorized OAuth sessions or separate expiring automation credentials, authorization-filtered tool discovery, immutable signed releases, deterministic scope policy, fixed HTTPS destinations, bounded responses, validated structured output, and linked audit evidence. - [Assessment quickstart](https://null.select/docs/getting-started): Accepted inputs, report interpretation, repair workflow, managed access requirements, and production scope. - [Trust model](https://null.select/docs/safety-model): The separation between static claims, runtime enforcement, output validation, and audit evidence. - [Linux CLI](https://null.select/docs/cli): Immutable Apache-2.0 AMD64/ARM64 downloads, checksum and provenance verification, credential-safe doctor/install/uninstall commands, offline signed-evidence verification, and the exact supported-client matrix. ## Important semantics - MCP descriptions and annotations are untrusted claims unless backed by a trusted server and independent controls. - A clean static assessment is not a runtime certification. - Static assessment reports identity, authorization, secret handling, network enforcement, and audit coverage as `not_observable`. - Managed identity comes from the validated connected session or automation credential, never caller-supplied tenant headers. - Interactive OAuth uses PKCE S256, exact resource and tool consent, bounded refresh rotation, connected-session inventory, and next-request revocation. Codex CLI 0.162.1 and Claude Code 2.1.299 are production-verified OAuth clients. - Runtime rechecks organization, source, environment, tool, principal, credential, and deterministic usage state before dispatch. A source stop removes only that source's release members; an organization stop denies all managed discovery and execution while administration, evidence reads, and resume remain available. - Published releases are content-digested, signed, assessed, and immutable. - Source refresh creates a new immutable revision only for a semantic change; revision, release, and activation history remain inspectable. - Candidate publication retains input, authorization, output, destination, and evidence case outcomes plus digests and bounded dispatch facts without payloads. Only an exact retained passing attempt can bind a release. - Managed tools are read-only and use reviewed fixed public HTTPS endpoints, closed schemas, release-defined timeouts, and response-size bounds. The built-in read also uses a fixed method, path, argument allowlist, output projection, and redaction. - Remote source discovery accepts public HTTPS endpoints anonymously or with one write-only HTTP bearer bound to the exact organization, environment, and source. Read APIs return metadata only; rotation and removal affect the next dispatch across replicas. Private sources, redirects, proxy inheritance, other upstream authentication schemes, writes, arbitrary code, and OpenAPI or collection import are excluded. - Secret values and raw request or response payloads are excluded from audit events. - Each successful read returns an execution identifier, release digest, and audit-chain tip. - Verified execution detail uses `null.select.audit-export.v3`; it resolves the immutable release and exact activation authority, and links remote reads to the exact source revision, candidate attempt, and case-set digest without exposing payloads. - An authorized member can download one `null.select.evidence-packet.v1` ZIP containing a script-free owner summary, the complete audit export, offline instructions, and a canonical Ed25519-signed manifest. `nullselect evidence verify ` checks the exact archive, file digests, signature, audit chain, release evidence, and activation evidence without a token or network connection. Raw arguments, prompts, outputs, upstream bodies, and secrets are excluded. ## Writing - [What an MCP tools/list response cannot prove](https://null.select/blog/what-tools-list-cannot-prove) - [Journal](https://null.select/blog) ## Machine-readable resources - [Full product context](https://null.select/llms-full.txt) - [Sitemap](https://null.select/sitemap.xml) - [RSS](https://null.select/rss.xml)