DEV Community

Edison Flores
Edison Flores

Posted on

I built a protocol for AI agents to discover, evaluate, and install MCP skills autonomously

#ai #agents #mcp #protocol

The problem

AI agents (Claude Desktop, Cursor, Cline) can install MCP servers to extend their capabilities. But there's no standard way for agents to:

  1. Discover which MCP servers exist
  2. Evaluate if a server is safe to install
  3. Purchase paid skills autonomously
  4. Verify the install succeeded
  5. Recover from failures

I built the MarketNow Agent Protocol (MAP) — a lightweight protocol that solves all 5.

The protocol 

Agent → Discover → Search → Evaluate → Verify → Install → Pay → Report
Enter fullscreen mode Exit fullscreen mode

Step 1: Discover 

GET /api/manifest
Enter fullscreen mode Exit fullscreen mode

Returns ALL endpoints, stats, payment info, and discovery URLs in one call. Agents fetch this once.

Step 2: Search 

POST /api/mcp
{"jsonrpc":"2.0","id":1,"method":"tools/call",
 "params":{"name":"search_skills","arguments":{"query":"github"}}}
Enter fullscreen mode Exit fullscreen mode

Returns real skills with install commands and sentinel scores.

Step 3: Evaluate 

GET /api/trust-score?skillId=mn-mcp-filesystem
Enter fullscreen mode Exit fullscreen mode

Returns:

{
  "trust_score": 10,
  "recommendation": "safe_to_install",
  "certificate_url": "https://marketnow.site/api/audit-skill?certificate=1&skillId=mn-mcp-filesystem"
}
Enter fullscreen mode Exit fullscreen mode

Agents use this to make autonomous decisions:

  • safe_to_install (score ≥ 8) → install without human approval
  • install_with_caution (score 5-7) → warn human first
  • do_not_install (score 0-1) → refuse

Step 4: Verify 

GET /api/audit-skill?certificate=1&skillId=X
Enter fullscreen mode Exit fullscreen mode

Returns a signed SHA-256 certificate with 8 audit layers:

  • L1.5: Static analysis (deps, secrets, licenses)
  • L1.6: Pattern-based behavioral analysis
  • L2: Active probe (60+ adversarial inputs)
  • L2.5: gVisor sandbox (userspace kernel isolation)
  • L2.6: Egress proxy with domain allowlist
  • L4: SBOM + OSV vulnerability check
  • L4.5: Content fingerprint (SHA-256 of repo HEAD)

Step 5: Install 

npx -y marketnow-mcp
Enter fullscreen mode Exit fullscreen mode

Step 6: Pay (autonomous) 

POST /api/agent-purchase
{
  "skillId": "mn-gen-00015",
  "walletAddress": "0x...",
  "txHash": "0x...",
  "paymentMethod": "usdc_base"
}
Enter fullscreen mode Exit fullscreen mode

USDC on Base L2. Human-in-the-loop by default (AP2 mandates).

Step 7: Report 

POST /api/mcp
{"method":"tools/call","params":{"name":"health","arguments":{}}}
Enter fullscreen mode Exit fullscreen mode

Returns {status: ok, total_skills: 8764, sentinel_version: "L2.5"}

Failure taxonomy

Agents need to self-diagnose. We created 15 structured failure codes:

GET /failure-taxonomy.json
Enter fullscreen mode Exit fullscreen mode
Code Description Agent action
NET_001 Cannot reach endpoint Retry 3x with backoff
PAY_001 Payment required Check mandate balance
TRUST_001 Score below threshold Warn user
SBOX_001 Sandbox violation Uninstall immediately
CERT_002 Certificate tampered Report as malicious

Full decision tree: agents check the failure code and take the recommended action automatically.

Agent discovery channels

Agents can discover MarketNow through:

  1. MCP Registry (official) — registry.modelcontextprotocol.io
  2. npm — npm search "mcp marketplace"
  3. A2A Protocol — GET /.well-known/agent.json
  4. MCP Discovery — GET /.well-known/mcp.json
  5. LLMs — GET /llms.txt (answer.ai convention)
  6. GitHub — topics: mcp-marketplace, agent-commerce
  7. Direct — npx -y marketnow-mcp

Results

  • 8,764 MCP servers indexed
  • 206 servers tested with gVisor sandbox
  • 3 servers removed for leaking env vars
  • 212 npm downloads in 1 day after MCP Registry listing
  • Listed in official MCP Registry
  • 59 countries with traffic

Try it 

# Install the MCP server
npx -y marketnow-mcp

# Or connect via HTTP
curl -X POST https://marketnow.site/api/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{}}}'
Enter fullscreen mode Exit fullscreen mode

Full protocol spec: GET https://marketnow.site/agent-protocol.json

MarketNow — the trust layer for agent commerce. Follow on GitHub.

Top comments (0)