What a recall watch actually has to do#
Break the job down before looking at servers. A quality or regulatory affairs function doing recall monitoring is running five distinct things: a standing watch on agency publications; a lookup when a customer complaint, a supplier notice or a trade press item lands; a traceable citation back to the source record so a decision can be defended later; a supplier-side check on whether a firm or an import is in good standing; and an entry in the system of record that proves the organisation responded.
Only the first four are read operations, and only read operations are plausibly served by what is in this catalog today. The fifth is not: no server among the 33 we publish is described as a quality-management, complaint or CAPA system. The nearest things we list are general work trackers — Atlassian, monday, Linear, Notion — which is not the same category of tool. The erp-and-supply-chain category exists in our taxonomy and is published with zero servers. So an assistant wired to these tools speeds up the finding and the reading, and stops at the boundary where the record has to be created by a person in the system your auditors accept.
That boundary is not a disappointment, it is a scoping decision. The honest description of the win is that a weekly manual sweep of three agency websites becomes a query an analyst can ask in the tool they are already in, with the source record attached. The tools that matter for that are the single-record fetches — RecallRadar's get_recall, Argus HQ's get_warning_letter — because a search result without a retrievable source record is an assistant assertion, and an assistant assertion is not evidence.
What is actually published#
Four of the 33 servers in the catalog sit in food safety and compliance, and one more in a different category carries recall data. Three are directly useful here.
RecallRadar, published by withglint.app at version 1.0.0, advertised four tools when we connected on 19 September 2026: diff_since, get_recall, list_agencies and search_recalls. The publisher's own description gives the coverage as U.S. FDA, USDA FSIS and CPSC recalls, with access by "API key or x402". It is the only server in the catalog whose description names FSIS or CPSC, which matters if your exposure includes meat, poultry and egg products or non-food consumer goods sold alongside them.
Argus HQ, published by argushq.ai at version 1.0.0, advertised five tools: get_company_history, get_recall_by_lot, get_warning_letter, list_recent_actions and search_enforcement. Its declared scope is FDA enforcement data — warning letters, recalls, approvals and 483s. It is narrower by agency and wider by document type. Those two shapes answer different questions: RecallRadar tells you what has been recalled across three agencies and what changed since a date; Argus HQ tells you what the FDA has said to a given firm over time.
Atlas Verified (atlasverified.ai) is doing a different job — pre-incident rather than post-incident. Its description is organic supply chain verification: certification, OFAC and FDA import checks. It requires credentials: an unauthenticated initialize returned HTTP 401, with a full OAuth chain in place, including protected-resource metadata and a dynamic client registration endpoint. Its 32 published scopes give the clearest picture of its surface, since the tool list cannot be read without a token. Fourteen are read scopes including suppliers:read, verification:read, shipments:read and tradedata:read; fourteen are write scopes including suppliers:write, verification:write, paperwork:write, signatures:write and ingestion:write. The remaining four — mcp:*, readonly, chat and documents — carry no read or write suffix.
fmcg.network, at version 0.6.1, bundles "FDA recall watch" with USDA FoodData Central nutrient lookup and EU FMCG labelling. It also returned 401 with OAuth and dynamic registration available, so its tool names could not be enumerated and the depth of the recall side is not visible from outside. We file it under market and consumer intelligence rather than food safety because of that bundle, not because the recall claim is doubted.
One server in the food safety category is not a recall source at all: DAG Studio MCP is causal DAG analysis — backdoor paths, adjustment sets, bias simulation, described as validated against dagitty. That is a different kind of instrument, for a root-cause or epidemiological argument, and it is not a feed.
What adoption costs an IT team#
The first cost is architectural and unavoidable: none of the four declares an installable package, so all four are recorded as hosted-remote only over streamable HTTP, with no SSE remote declared. Six of the 33 servers in the catalog do publish a package; none of these does. That means no version to pin, no declared offline mode, and nothing in the records describing a way to run the component inside a validated environment of your own. During the one hour when a recall genuinely matters, availability is a third party's problem and your incident is still yours.
The second cost is that the two open servers publish nothing an identity team can attach to. Neither serves OAuth discovery metadata, so OAuth, dynamic registration, scopes and scope separation are all recorded as not documented or not checked. Nothing published tells you whether an individual analyst can be issued a revocable, read-scoped credential, or how you would evidence in a review that access was read-only — an unanswered question to put to the publisher, not a documented absence. RecallRadar's registry record declares one credential input, an Authorization header, optional and correctly marked secret; Argus HQ's record lists no credential input at all, and its secrets claim reads as not checked.
Invert the usual risk framing, though, and the picture changes. The payload here is public regulatory data, and the nine tool names enumerated across the two open servers are all retrieval verbs: search, get, list, diff. No write-shaped tool was advertised. The material exposure is therefore not exfiltration of your data but disclosure of your questions. A diff_since poll or a search naming a supplier, a brand or a lot code tells the operator of that endpoint what your quality team is worried about, and a repeated poll tells them your watch list. For all four servers, retention, audit logging, access control and data residency are recorded as not documented — sixteen claims, not one of them answered. You cannot tell a supplier audit where those queries are stored or for how long, because nobody has said.
The practical mitigation is cheap and worth doing on day one: route the calls through an egress proxy you control and keep the query log on your side. Nothing published commits any of these publishers to giving you one.
Atlas Verified inverts the trade. You get a real authorisation story — protected-resource metadata, a registration endpoint at api.atlasverified.ai/register, 32 named scopes including a blanket readonly — which is more than most of the catalog offers and enough to issue a narrow token. What you do not get before you hold credentials is the tool list: the endpoint returned 401, so we could not enumerate it. Fourteen write scopes are visible, and paperwork:write, signatures:write and ingestion:write are not casual grants. Ask the vendor for the tool inventory and the scope-to-tool mapping before an assistant is allowed anywhere near a token that includes them.
What "vendor-verified" means here, and what it does not#
All 33 servers we publish carry the maintainer type vendor-verified, and all four discussed here reached it the same way: the registry namespace resolves to a domain the publisher controls and the endpoint host sits inside that domain. app.withglint.recallradar maps to withglint.app; ai.argushq to argushq.ai; ai.atlasverified to atlasverified.ai; network.fmcg to fmcg.network. That is a provenance test. It says the thing at the end of the URL is run by the party whose name is on the package. It says nothing about company size, track record, financial stability or data quality.
The four score identically on our curation scale — 80 each, assembled from exactly the same three components: verified domain, a reachable endpoint, and a well-formed authentication or initialize response. A score built from those inputs cannot distinguish a deep enforcement archive from a thin proxy over a public API, and it is not trying to. So an evaluator has to read the signals underneath it.
Those signals are thin and worth stating plainly. Three of the four are at version 1.0.0 and fmcg.network at 0.6.1. Documented claim coverage runs from 6 of 18 for Argus HQ and 7 of 18 for RecallRadar, through 8 for fmcg.network, to 10 for Atlas Verified — against a catalog mean of 9.4. Three of the four declare no public repository at all. Argus HQ does declare one, at github.com/andrewjgaber-commits/empire-distribution: a personal namespace whose repository name does not match the product. We record the repository as public on the strength of that declaration and have not checked its licence or last commit; both read as not checked. Contrast the fourth server in the category, DAG Studio, where the repository was read: Apache-2.0, last push 61 days before the check. A repository link is worth what has been verified about it.
The reasonable conclusion is not that these servers are untrustworthy. It is that they are small, single-endpoint dependencies run by young publishers, and should be governed as such: a named internal owner, a review date, and an accepted answer to the question of what happens the week the endpoint stops responding. By the publishers' own descriptions, everything behind these tools is public agency data, so that failure costs you convenience and speed rather than data. That is the argument for adopting them quickly and depending on them lightly.
A pilot that fits the evidence#
Start with the two open servers, because there is nothing to procure. Both answered an unauthenticated initialize on 19 September 2026 — two of only five servers in the whole catalog that did — so a trial is a configuration entry in a client, reviewed by whoever governs outbound connections, not a contract. Run them both: they overlap on FDA and diverge usefully elsewhere.
Design the trial around the number nobody publishes. No registry record among the four states a refresh cadence, and we do not track data freshness as a claim, so lag is the thing to measure yourself. Take ten historical events in your own categories — ideally ones your team handled — and run them through search_recalls and search_enforcement. Check three things: whether the event is present at all, how long after the agency posting it appeared, and whether get_recall or get_warning_letter returns a record you would be willing to paste into an internal note. Completeness and lag decide whether this replaces a manual sweep or merely supplements one. Nothing on the page can tell you that; your categories can.
Keep the assistant's permissions honest to what is there. Across both open servers the nine advertised tools are all retrieval-shaped, so a read-only posture is the natural one — but it is a property of what was advertised, not a guarantee enforced by a scope system, because neither server publishes scopes. Treat the write question as unanswered rather than answered in your favour.
Handle Atlas Verified on a separate track, because it is a different purchase with a different question attached. It sits on the supplier side, before an incident, and it has both the strongest authorisation story in this group and the least visible tool surface. Ask for the tool list and the scope mapping, then ask for a token scoped to readonly or to the specific read scopes you need, and decline the write scopes until there is a named workflow that requires them.
Finally, write the boundary into the runbook. The output of any of these tools is a lead: it tells a human where to look and what to read. The determination, the hold, the customer notification and the record that proves you acted stay in systems none of these four servers reaches, and no server in the catalog is described as a quality-management, complaint or CAPA system. Building the pilot that way costs nothing now and saves an argument later.