For MCP server maintainers

Get your MCP server verified

Approving a listing means it meets our basic bar. Verified means a person has gone through the server itself: what it can touch, how it handles credentials, and whether its tools do what they say. $99 one-time ($49 with Maintainer Pro). We aim to send findings within 3 business days.

Read a complete sample review (chrome-devtools-mcp 1.12.0) to see exactly what you get.

Which server?

Pick one of the servers you published, or open your server's listing page and use “Get it verified” there. That works for listings we added on your behalf too.

Choose from my servers Not listed yet? Submit it free first

What we check

Credentials and secrets

How keys and tokens are passed, stored and scoped. Plaintext secrets in config, over-broad OAuth scopes.

What it can do

File reads and writes, shell commands, network calls, database or cloud writes. We record each one on your listing.

Install path

The package or endpoint users actually install, its dependencies and install scripts.

Tool descriptions

Hidden instructions, prompt-injection bait, or claims the code doesn't back up.

Hosted servers get the same review against the live endpoint, its auth flow and its docs. If we need a test account or repo access, we'll ask.

What you get

Written findings by email, whatever the result
If it meets our bar: your README badge switches from "approved" to "verified" on its own
If it meets our bar: your listing shows its risk level and capabilities, and joins our Certified list and filter
Not a pass yet? You get the findings, and we'll take another look after your fix at no extra charge

Good to know

It's our informational opinion of the version we look at, not a security audit, penetration test, warranty or endorsement. Ship a major change and you can book a fresh review.
Paying doesn't buy a pass, and it never affects whether your listing is approved.
If we can't carry out the review (for example, we can't get access to the code or a working endpoint), we'll refund it.
The full plain-language terms are here.
Questions first? Email [email protected].