epistery.com

What It Is

Epistery Scan positions itself as a “Search the Signed Web” search and discovery service. It indexes websites that publish a /.well-known/ai manifest under the AI Discovery Standard and include authored, cryptographically signed data. Unlike traditional search engines that crawl and reorganize content, it emphasizes indexing only data that organizations explicitly publish and sign. Its trust foundation comes from blockchain, which is used for signature verification, identity binding, and proof of provenance.

Core Capabilities and Security Dimensions

From a cybersecurity perspective, Epistery is not a WAF, EDR, firewall, or vulnerability scanning product. Instead, it focuses on trusted source discovery and identity verification. Users can search by keyword, organization name, or domain, and can also query a domain’s manifest and trust status. Results come from the Signed Web and MCP Registry, with trust levels labeled as Verified, Signed, and Open: Verified means the signature matches an on-chain identity; Signed means the content is cryptographically signed but not yet verified on-chain; Open means it has been published but not signed. This mechanism can help reduce source spoofing, impersonation, and opacity in AI service and organizational content discovery.

Deployment, Integration, and Management

On the user side, interaction mainly happens through web search, domain lookup, and the Discovery page. On the publishing side, organizations need to publish a /.well-known/ai manifest under their own domain, after which Epistery can discover, index, and display it. For integration, it supports MCP Registry and allows users to route queries to live MCP services using an @service-name prefix, such as @stripe or @github; Epistery selects the matching tool and invokes it on the user’s behalf. In terms of management and alerting, the source text only indicates trust label display, and does not mention centralized management, audit logs, risk alerts, or SIEM integration.

Pricing, Pros and Cons, and Who It Is For

The source text does not disclose pricing, plans, payment methods, SLA, customer support, or compliance certifications, so there is insufficient information for commercial procurement. Its strengths are a clear concept and a trust index built around signed publishing, on-chain identity, and provenance. It is suitable for organizations adopting the AI Discovery Standard, MCP service providers, and developers who need to verify domain manifests and service origins. Its limitations are that it depends heavily on ecosystem adoption, and its coverage depends on websites that actively publish manifests and on MCP registry sources. It is also not a traditional security protection product and cannot replace vulnerability management, endpoint protection, or perimeter security solutions.

China Access and Alternative Considerations

The source text does not provide information on access from mainland China, network connectivity, or payment, so china_access can only be assessed as unknown. For teams in China, it is advisable to first verify whether epistery.com is directly reachable, whether MCP service calls are stable, and whether the related blockchain verification paths are accessible. If the requirement is enterprise security protection, consider domestic or international WAF, zero-trust, vulnerability scanning, EDR, or SIEM products. If the requirement is trusted AI service discovery and signed content indexing, Epistery is a relatively exploratory tool.