Two weeks ago we launched MarketNow — the trust layer for agent commerce. Here's what happened.
By the numbers
| Metric | Value |
|---|---|
| Requests (Cloudflare) | 55,807 |
| Countries | 63 |
| npm weekly downloads | 675 |
| dev.to articles | 8 |
| MCP skills indexed | 8,560 |
| Free skills | 43 |
| Languages supported | 5 (EN, ES, PT, ZH, FR) |
| Security vulnerabilities | 0 |
| Pentest findings fixed | 4 CRITICAL, 5 HIGH, 7 MEDIUM |
Top countries
US 21,718 (39%) ███████████████████
GB 14,077 (25%) ████████████
EC 4,648 ( 8%) ████
NL 3,898 ( 7%) ███
CA 2,029 ( 4%) █
BR 1,563 ( 3%) █
FR 1,337 ( 2%) █
HK 813 ( 1%) ▌
ES 679 ( 1%) ▌
PL 612 ( 1%) ▌
Asia is present: China (361), Hong Kong (813), Taiwan (244), Japan (407), Korea (200), Singapore (330), India (542).
What we built in 2 weeks
Security (pentested and fixed)
- 4 CRITICAL vulnerabilities found and fixed: mandate cap bypass, txHash replay, amount mismatch, stolen txHash redemption
- CORS allowlist (no more
*) - Webhook URL allowlist (anti-SSRF)
- CSP + security headers on all routes
-
crypto.randomBytesfor license keys - Fail-closed on every payment path
Performance
- In-memory skills cache (4.5MB, 5min TTL) — 700+ cache hits, 0 memory growth
- 4-endpoint Base RPC pool with automatic failover
- Rate limiting (per-IP, 60/min search, 20/min purchase)
- 200 concurrent users: 0% error, p95=1.09s
- skills-lite.json: 4.5MB (down from 30MB skills.json)
i18n (5 languages)
- Full translation system: EN, ES, PT, ZH, FR
- 400+ strings per language
- 23 pages fully translated
- Language selector with flags (🇺🇸🇪🇸🇧🇷🇨🇳🇫🇷)
- Hreflang tags for Google, Bing, Baidu, Yandex
SEO
-
<noscript>SEO content for crawlers (Googlebot, Bingbot, Baiduspider) - robots.txt: 53 User-agent blocks (Google, Bing, Baidu, Sogou, 360, Yandex, Naver, DuckDuckGo)
- llms.txt for AI crawlers (ChatGPT, Claude, Perplexity, Meta AI, ByteDance)
- Sitemap: 40 URLs, all 200
- JSON-LD: Organization + WebSite + SearchAction + ItemList
- Yandex Webmaster verified
- Bing IndexNow: 12 URLs submitted (HTTP 202)
Discovery
- npm package v1.4.0 published (675 weekly downloads)
- 8 dev.to articles (security, i18n, x402, payments, top MCP servers)
- GitHub issue opened on modelcontextprotocol/servers
- Smithery listing (84/100 quality score)
- Glama.ai indexed
- mcp.so listing (stale — needs manual update)
What's next
- Reddit + Hacker News — posts ready, need to publish
- Google indexing — SEO content restored, requesting recrawl
- Seller onboarding — make it easy for developers to publish skills
- More AI crawlers — ChatGPT and Claude should be able to find and recommend MarketNow
- Chinese platforms — Gitee, CSDN, Zhihu (need Chinese phone for Baidu verification)
Try it
# Install MCP server
npx -y marketnow-mcp
# Search skills
curl "https://marketnow.site/api/search?q=scraper&limit=5"
# Get a free skill
curl -X POST "https://marketnow.site/api/agent-purchase" \
-H "Content-Type: application/json" \
-d '{"skillId":"mn-prompt-63712dff"}'
Site: https://marketnow.site
Source: https://github.com/edgarfloresguerra2011-a11y/marketnow
npm: https://www.npmjs.com/package/marketnow-mcp
AliceLabs LLC (Wyoming, USA). Solo founder Edison Flores. No investors, no employees, built in public.
Top comments (3)
Marketplace growth gets more interesting when the install path is observable. Downloads are a signal, but the stronger metric is whether users can connect, run a first workflow, and know what failed.
Great point @alexshev — downloads are a vanity metric. The real signal is: did the agent actually connect, complete a workflow, and self-diagnose failures?
We are building toward that. Currently exposed:
Missing (roadmap):
Would love your thoughts on what an agent-observable install path should look like.
That exposed health surface is a good start. The next useful signal is whether the agent can turn those states into a recovery choice: retry later, switch endpoint, ask for credentials, or stop with a useful reason.