For MCP server maintainers
Get your MCP server verified
Approving a listing means it meets our basic bar. Verified means a person has gone through the server itself: what it can touch, how it handles credentials, and whether its tools do what they say. $99 one-time ($49 with Maintainer Pro). We aim to send findings within 3 business days.
Read a complete sample review (chrome-devtools-mcp 1.12.0) to see exactly what you get.
Server
TryPost
Run your social media on autopilot with AI agents.
One-time payment via Stripe. Sign-in required so we can send you the findings.
What we check
Credentials and secrets
How keys and tokens are passed, stored and scoped. Plaintext secrets in config, over-broad OAuth scopes.
What it can do
File reads and writes, shell commands, network calls, database or cloud writes. We record each one on your listing.
Install path
The package or endpoint users actually install, its dependencies and install scripts.
Tool descriptions
Hidden instructions, prompt-injection bait, or claims the code doesn't back up.
Hosted servers get the same review against the live endpoint, its auth flow and its docs. If we need a test account or repo access, we'll ask.
What you get
- Written findings by email, whatever the result
- If it meets our bar: your README badge switches from "approved" to "verified" on its own
- If it meets our bar: your listing shows its risk level and capabilities, and joins our Certified list and filter
- Not a pass yet? You get the findings, and we'll take another look after your fix at no extra charge
Good to know
- It's our informational opinion of the version we look at, not a security audit, penetration test, warranty or endorsement. Ship a major change and you can book a fresh review.
- Paying doesn't buy a pass, and it never affects whether your listing is approved.
- If we can't carry out the review (for example, we can't get access to the code or a working endpoint), we'll refund it.
- The full plain-language terms are here.
- Questions first? Email [email protected].