Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "marketnow": {
      "type": "http",
      "url": "https://marketnow.site/api/mcp/"
    }
  }
}

claude mcp add --transport http marketnow https://marketnow.site/api/mcp/

[mcp_servers.marketnow]
url = "https://marketnow.site/api/mcp/"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "marketnow": {
      "type": "remote",
      "url": "https://marketnow.site/api/mcp/",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "marketnow": {
      "type": "http",
      "url": "https://marketnow.site/api/mcp/"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=marketnow&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWFya2V0bm93LnNpdGUvYXBpL21jcC8ifQ%3D%3D"
}

{
  "servers": {
    "marketnow": {
      "type": "http",
      "url": "https://marketnow.site/api/mcp/"
    }
  }
}

{
  "mcpServers": {
    "marketnow": {
      "httpUrl": "https://marketnow.site/api/mcp/"
    }
  }
}

extensions:
  "marketnow":
    enabled: true
    name: "marketnow"
    type: streamable_http
    uri: "https://marketnow.site/api/mcp/"
    timeout: 300

Quality 63 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene71 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: marketnow_translate_credential (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); marketnow_check_domain (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); marketnow_submit_skill (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
pass
tools.token_costabout 1,082 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes20 tool changes in 30 days
fail
stability.rug_pull3 tools kept their name but changed most of their description in 30 days; review before trusting them

dependencies67 · weight 15

pass
deps.known_vulnsno known advisory in 16 resolved packages
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 0.5.0 has 1 known advisory (GHSA-w48q-cv73-mx4w); update @modelcontextprotocol/sdk to 1.24.0 or later
pass
deps.resolvable[email protected] resolved: 16 packages

9 tools, about 1,082 tokens to load them all · tool set 7a1e19aefe32 · tools last changed 2026-10-10 · checked 2026-10-20 17:02 UTC

Tool changes

2026-10-10marketnow_submit_skillchangedtitle, description, input schema, annotations
before
Publish a skill to the MarketNow catalog (the write side). The package is validated and Sentinel-scanned (injection patterns, embedded secrets, dangerous APIs, suspicious URLs, typosquat, dedup against the 70k+ catalog) AND its claims are verified live: repo_url must exist (HTTP 200), install must reference a real package on npm/PyPI/crates/Docker Hub. False claims are rejected (422). Accepted skills with real substance (files/code/verifiable repo) are stored in the public auditable queue as certified-L1.5, pending L2 review and catalog merge. Description-only submissions are accepted but never merged. Any pricing model is accepted — free, per-call (x402), subscription or custom: the vendor sets the price, MarketNow verifies the security. No authentication required. Do NOT include secrets — the scanner rejects them.
after · 83% of words in common
Publish a skill to the MarketNow catalog (the write side). The package is validated and Sentinel-scanned (injection patterns, embedded secrets, dangerous APIs, suspicious URLs, typosquat, dedup against the 69k+ catalog) AND its claims are verified live: repo_url must exist (HTTP 200), install must reference a real package on npm/PyPI/crates/Docker Hub. False claims are rejected (422). Accepted skills with real substance (files/code/verifiable repo) are stored in the public auditable queue as certified-L1.5, pending L2 review and catalog merge. Description-only submissions are accepted but never merged. No authentication required. Do NOT include secrets — the scanner rejects them.
2026-10-10marketnow_fingerprint_toolchangedtitle, annotations
2026-10-10marketnow_check_revocationchangedtitle, annotations
2026-10-10marketnow_search_skillschangedtitle, description, annotationsmeaning changed
before
Search the MarketNow registry of 70k+ indexed MCP servers across 8 sources (npm, PyPI, GitHub, official-registry, Smithery, crates, Docker, curated), security-first scored, with live auth-gate state on official-registry endpoints — filter by auth openness (open/gated/late-gate/hard-gate) via /api/skills?auth=.
after · 36% of words in common
Search the MarketNow registry of indexed MCP servers (69k+ across GitHub, npm and PyPI, security-first scored).
2026-10-10marketnow_check_domainchangedtitle, annotations
2026-10-10marketnow_get_pipelinechangedtitle, description, annotations
before
Get the 12-stage credential-verification pipeline details (PARSE→DECISION).
after · 70% of words in common
Get the 12-stage verification pipeline details.
2026-10-10marketnow_list_formatschangedtitle, description, annotationsmeaning changed
before
List all 9 supported credential adapter formats (ATC, EAT-AI, ZTA, A2A, MCP Card, W3C VC, OAuth, SPIFFE, X.509) with their algorithms and status.
after · 39% of words in common
List all 8 supported credential formats with their algorithms and status.
2026-10-10marketnow_translate_credentialchangedtitle, description, annotations
before
Translate a credential between the 9 adapter formats (ATC, JWT/OAuth, W3C VC, A2A, EAT-AI, ZTA, MCP Card, SPIFFE, X.509). Lossless conversion through Universal Trust Schema (UTS). See /api/trust?action=formats.
after · 71% of words in common
Translate a credential between 8 formats (ATC v3, JWT, W3C VC, A2A, EAT-AI, ZTA, MCP Card, X.509). Lossless conversion through Universal Trust Schema (UTS).
2026-10-10marketnow_verify_trustchangedtitle, description, annotations
before
Verify any AI agent credential (ATC v3, JWT/OAuth, W3C VC, MCP Card, A2A, EAT-AI, ZTA, SPIFFE SVID, X.509) through the UTA 12-stage credential-verification pipeline (PARSE→DECISION — distinct from Sentinel's 12 skill-audit stages). Returns validity, format, trust score, and issues.
after · 72% of words in common
Verify any AI agent credential (JWT, W3C VC, MCP Card, ATC v3, A2A, EAT-AI, ZTA, X.509) through the UTA 12-stage verification pipeline. Returns validity, format, trust score, and issues.
2026-10-05marketnow_submit_skillchangeddescription
before
Publish a skill to the MarketNow catalog (the write side). The package is validated and Sentinel-scanned (injection patterns, embedded secrets, dangerous APIs, suspicious URLs, typosquat, dedup against the 68k+ catalog) AND its claims are verified live: repo_url must exist (HTTP 200), install must reference a real package on npm/PyPI/crates/Docker Hub. False claims are rejected (422). Accepted skills with real substance (files/code/verifiable repo) are stored in the public auditable queue as certified-L1.5, pending L2 review and catalog merge. Description-only submissions are accepted but never merged. Any pricing model is accepted — free, per-call (x402), subscription or custom: the vendor sets the price, MarketNow verifies the security. No authentication required. Do NOT include secrets — the scanner rejects them.
after · 98% of words in common
Publish a skill to the MarketNow catalog (the write side). The package is validated and Sentinel-scanned (injection patterns, embedded secrets, dangerous APIs, suspicious URLs, typosquat, dedup against the 70k+ catalog) AND its claims are verified live: repo_url must exist (HTTP 200), install must reference a real package on npm/PyPI/crates/Docker Hub. False claims are rejected (422). Accepted skills with real substance (files/code/verifiable repo) are stored in the public auditable queue as certified-L1.5, pending L2 review and catalog merge. Description-only submissions are accepted but never merged. Any pricing model is accepted — free, per-call (x402), subscription or custom: the vendor sets the price, MarketNow verifies the security. No authentication required. Do NOT include secrets — the scanner rejects them.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 67 / 100

provenance90

liveness0

freshness100

hygiene100

+repository +namespace-matches-repo +website -unreachable(6 failures) +updated-16d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

[email protected] npm15 dependencies, resolved · MCP SDK @modelcontextprotocol/sdk 0.5.0 · advisories checked 2026-10-19

advisory	severity	package	fixed in
GHSA-w48q-cv73-mx4wModel Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default	high	`@modelcontextprotocol/[email protected]`MCP SDK, direct	fixed in `1.24.0`

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://marketnow.site/api/mcp/` streamable-http	none	no (6 failures)	83%	389 ms	2025-03-26	2026-10-10

package	registry	version	runtime	secrets
`marketnow-mcp`	npm	1.15.0	–

Tools (9)

`marketnow_check_domain`	Check if a domain is suspicious (scam checker). Returns risk score and reasons.
`marketnow_check_revocation`	Check the revocation status of an Agent Trust Card (card_id) or CA key (kid) against the signed MarketNow Revocation Registry (MNR-CRL-1.0) + live ledger. Returns VALID/EXPIRED/REVOKED/SUPERSEDED/UNKNOWN with PERMIT/DENY recommendation. Fail-closed: unknown subjects answer UNKNOWN+DENY. The signed CRL layer is independently verifiable via Ed25519 (RFC 8785 JCS).
`marketnow_fingerprint_tool`	Cryptographically fingerprint MCP tool definitions (OWASP MCP Cheat Sheet: 'verify tool descriptions haven't changed'). Computes RFC 8785 JCS + sha256 per tool plus a manifest fingerprint for the whole tools/list surface. Pass a previous manifest in 'pinned' to get a drift report (added/removed/changed) — the core defense against tool poisoning and rug-pull redefinitions.
`marketnow_get_pipeline`	Get the 12-stage verification pipeline details.
`marketnow_list_formats`	List all 8 supported credential formats with their algorithms and status.
`marketnow_search_skills`	Search the MarketNow registry of indexed MCP servers (69k+ across GitHub, npm and PyPI, security-first scored).
`marketnow_submit_skill`	Publish a skill to the MarketNow catalog (the write side). The package is validated and Sentinel-scanned (injection patterns, embedded secrets, dangerous APIs, suspicious URLs, typosquat, dedup against the 69k+ catalog) AND its claims are verified live: repo_url must exist (HTTP 200), install must reference a real package on npm/PyPI/crates/Docker Hub. False claims are rejected (422). Accepted skills with real substance (files/code/verifiable repo) are stored in the public auditable queue as certified-L1.5, pending L2 review and catalog merge. Description-only submissions are accepted but never merged. No authentication required. Do NOT include secrets — the scanner rejects them.
`marketnow_translate_credential`	Translate a credential between 8 formats (ATC v3, JWT, W3C VC, A2A, EAT-AI, ZTA, MCP Card, X.509). Lossless conversion through Universal Trust Schema (UTS).
`marketnow_verify_trust`	Verify any AI agent credential (JWT, W3C VC, MCP Card, ATC v3, A2A, EAT-AI, ZTA, X.509) through the UTA 12-stage verification pipeline. Returns validity, format, trust score, and issues.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "io.github.alicelabs-llc/marketnow",
  "title": "MarketNow",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://marketnow.site/api/mcp/",
      "type": "streamable-http"
    }
  ],
  "version": "1.16.0",
  "packages": [
    {
      "version": "1.15.0",
      "transport": {
        "type": "stdio"
      },
      "identifier": "marketnow-mcp",
      "registryType": "npm"
    }
  ],
  "repository": {
    "url": "https://github.com/alicelabs-llc/MARKETNOW",
    "source": "github"
  },
  "websiteUrl": "https://marketnow.site",
  "description": "Verify agent credentials, 9 formats, scam domains; search 70k+ MCP servers with auth-gate state."
}