gem-hunter
Language: TypeScript
992 AI tools, 1,979 MCP servers and 1,638 Claude Code skills — with a sourced trust & security report per vendor. If we couldn't verify it, the field stays empty.
Every compliance claim links to the vendor page that proves it. Where a fact is unverified, the field stays empty instead of guessed.
| Count | What it is | |
|---|---|---|
| 🛠️ AI tools | 993 | Searchable, filterable catalog with pricing, compliance, and data-handling metadata |
| 🔌 MCP servers | 1,979 | Indexed Model Context Protocol servers |
| 🧩 Claude Code skills | 1,638 | Indexed Claude Code skills |
| 🛡️ Trust & Security Reports | 971 | Per-vendor reports, every certification backed by a verbatim source quote |
The governing rule across all of it:
nullmeans unverified, not zero. We never guess.
Most AI directories are a wall of logos. AIFOXX records the things that are genuinely hard to compare across vendor marketing pages, and it sources every claim:
true links to the vendor's own trust center, security page, or privacy policy.The tool page shows a compact summary. The full Trust & Security Report at /trust/:slug goes deeper: the complete certification list (SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, and more) with a sourced quote for each, data-processing-agreement and data-region details, per-product data scope, and a "what to watch" summary. The summary and the report are driven by the same data, so they never disagree.
| Route | Page |
|---|---|
/ |
Tool listing with search and filters |
/ai/:slug |
Single tool, plus related Claude skills |
/category/:category |
Tools by category |
/trust and /trust/:slug |
Vendor Trust & Security Reports |
/compare/:a/vs/:b |
Side-by-side comparison |
/best and /best/:slug |
Best-of category guides |
/skills and /mcp |
Claude Code skills and MCP server indexes |
/news |
Daily-updated AI news feed |
git clone https://github.com/withkarann/aifoxx.git
cd aifoxx
npm install
npm run devThe dev server runs on http://localhost:8080 (configured in vite.config.ts).
| Command | Description |
|---|---|
npm run dev |
Start the Vite dev server |
npm run build |
Generate the sitemap, then build the static site |
npm run typecheck |
Type-check with tsc --noEmit |
npm run lint |
Run ESLint |
npm run test |
Run the Vitest unit tests |
npm run validate |
Check tools.json for required fields and duplicate slugs |
npm run check |
typecheck, lint, validate, build (the full gate) |
npm run sitemap |
Regenerate sitemap.xml |
src/
├── routes.tsx # Route table (vite-react-ssg)
├── App.tsx # Root layout
├── pages/ # One file per route (Home, ToolDetail, Trust, News, Compare, Best, ...)
├── lib/ # Data access, search, helpers
├── types/ # Zod schemas (single source of truth for shape)
└── data/
├── tools.json # Tool catalog (human-editable source)
├── mcp-servers.json # MCP servers
├── claude-code-skills.json# Claude Code skills
├── news.json # AI news items
├── best-categories.json # Best-of category guides
├── trust-index.json # Trust report hub listing
├── trust-badges.json # Per-tool compliance summary
└── trust/<slug>.json # One Trust & Security Report per vendor, loaded on demand
The site is a static SPA: no backend, no database. Pages read from src/lib/; components never import JSON data directly. Each vendor's report is its own file, so opening a report downloads only that vendor's data, and every page is pre-rendered to static HTML so its full content is indexable.
AIFOXX lists AI tools that a person or a team can evaluate on how they handle data: what they store, where they store it, whether they train on your input, and what they can prove. Every entry is checked against the live site before it goes in.
Some things are out of scope, and submissions in these areas are declined:
The featured slot on the home page holds products built by the people who maintain AIFOXX, and it says so on the page. Those products are listed with the same fields, the same verification, and the same unproven claims left as null as everything else. Being featured is a disclosure, not a ranking, and it never moves a product up the catalog.
A listing is a judgement at a point in time, not a permanent record. Tools get removed when they shut down, when their claims stop checking out, or when they no longer meet the bar. Tools we declined before can be listed later if what they offer changes. The catalog is curated on purpose, so it will keep moving.
Listed here and want it taken down? Open a tool removal request. If it is your product, you do not need to give a reason. GOVERNANCE.md covers how these calls are made, and SUPPORT.md points you at the right form for everything else.
Found something wrong or out of date? Two quick paths:
src/data/tools.json. Edit it directly and open a PR. Include a source URL on the vendor's own domain for any factual change, run npm run validate, and you are done.Submitting a new tool? Open an issue with the product name, URL, category, a short description, and links to the privacy policy and terms. Submissions are verified against the live site before they are added.
See CONTRIBUTING.md for full setup and the pre-PR checklist.
Facts are compiled from each vendor's own public pages: trust centers, security pages, and privacy policies. Every compliance flag set to true carries a source link to the page on the vendor's own domain that supports it. Trademarks, product names, and logos belong to their respective owners and are used only to identify the tools. News items link to their original publishers.
Every entry here is read and checked by hand against the vendor's own trust, security, and privacy pages. Nothing is collected automatically and published unchecked, which is slow, and it is the whole reason the data is worth anything.
If that saves you time, three things help, in order of how much they help:
Please do not open a public issue for security reports. See SECURITY.md.
MIT © 2026 Karan Rajeshbhai Mungara and Aanjaneya Singh Dhoni