The numbers, straight up:
MarketNow now tracks 130,845 MCP servers across 9 sources. Every one of the 66,496 index-certified entries passed the same 10 automated checks — source provenance, dedupe, real install-command parsing, install-risk classification, link integrity. The top 688 npm tarballs were deep-scanned with a 29-rule Sentinel code analysis: 116 clean, 160 with warnings, 409 flagged. Behind all of it: 684,912 individual automated checks, all reproducible from live endpoints.
Is this the biggest MCP directory on the internet? No — larger raw aggregates exist (one competitor lists 105k+ entries by merging every public registry they can find, with no quality gate). What we claim is narrower and, we believe, more useful: the largest MCP index where every certified entry passed security gates instead of popularity scores.
That distinction is the entire product. Let me explain why.
Why popularity scores are the wrong default for MCP servers
An MCP server is not a webpage you visit. It's code that your agent — and increasingly your IDE, your CLI, your CI pipeline — executes. Install patterns like npx -y <pkg> or uvx <pkg> run registry code on every single invocation. That's arbitrary code execution as a business model.
Now think about how most directories rank servers: installs, stars, recency. The uncomfortable truth is that a malicious server with competent marketing accumulates exactly those signals. Typosquats of popular projects don't look suspicious — they look better than average honest projects, because they parasitize a name you already trust. A popularity score in this ecosystem isn't neutral; it's an attack surface.
So we flipped the model. In MarketNow, risk_level describes what running the install command actually does to your machine (red = registry code executed on every run; yellow = reviewable/sandboxed/network-only; green = verified trust chain), and trust_score_100 is an evidence heuristic — adoption, age, source signals, typosquat distance against 150 popular names, injection markers in descriptions. A trust score of 100 is only reachable with verified adoption (≥1,000 downloads/week or ≥500 stars). No amount of metadata grooming gets you there.
What "index-certified" actually means (and what it doesn't)
Honesty requires precision here, because the industry's marketing departments are not going to provide it.
L1 — index-certified (all 66,496 entries, 10/10 checks passing). Each entry has verifiable provenance (npm registry, GitHub, PyPI, or curated lists), passed dedupe across sources, has a parsed real install command, carries an install-risk classification, and exposes its evidence so you can disagree with our scoring. This level certifies the index, not the code.
What it does NOT mean: we did not read 66,496 codebases. Nobody has, and any directory claiming "every entry audited" is lying to you. That's why the word is index-certified, not verified.
L2 — Sentinel-scanned (688 top npm tarballs, 29 rules). The most-installed servers get their shipped artifacts deep-scanned: tool-poisoning patterns, prompt-injection markers in descriptions, dangerous API usage, exfiltration-style calls. Results so far: 116 clean, 160 flagged-warning, 409 flagged-error, 23 scan errors (fail-closed, they count against, not for). Coverage: 96.8% of the top-711 target set, ~5.28M weekly downloads represented.
L3 — trust chain (our own stack, live in production). Agent Trust Cards signed with Ed25519 (RFC 8032), canonical JSON per RFC 8785, a live OCSP-style revocation responder, a signed CRL, and a Sigstore Rekor transparency anchor (log index 2762061972) that makes our published artifacts tamper-evident.
Two-level honesty is also why the 64,349 aggregate entries are labeled exactly that — tracked, not certified. They're visible, counted, and explicitly not vouched for.
The stack behind it — 14 npm packages, zero vulnerabilities
The index sits on top of a trust stack that's fully public and installable today:
-
marketnow-mcp@1.10.3— MCP server with 15marketnow_*tools (search, scam-check, revocation, fingerprints...). Try it:npx -y marketnow-mcp -
@marketnow/trust-core@2.0.1— 92 exports: behavioral baselines, drift detection, capability policies, attack-chain detection, memory-poisoning scans, transparency log -
@marketnow/trust-gateway,@marketnow/trust-adapters— fail-closed runtime gate + 9 trust-card formats (ATC, EAT, ZTA, A2A cards, W3C VC, SPIFFE SVID, X.509...) -
@marketnow/cline-trust-plugin@1.1.0— pre-exec interceptor for Cline: vetoes tool calls against policy, blocks revoked cards, emits audit receipts -
@marketnow/uta-conformance@1.3.3— 14 signed conformance vectors, unlimited-card generator, reference scorer -
@marketnow/sentinel-rules@1.0.0— the same 29 rules as annpxscanner for your own repo - Plus
marketnow-audit(CI-friendly verdict CLI),marketnow-install-stack,agent-trust-card,@marketnow/uts -
@marketnow/trust-mcp-middleware— wraps any MCP server'stools/callwith the gateway: no credential, no execution, signed audit receipts -
@marketnow/uta-verify— one CLI, seven credential formats (ATC v3, JWT, W3C VC, A2A, EAT, ZTA, MCP), CI exit codes -
@marketnow/trust-observability— structured logging, tracing, Prometheus metrics, zero dependencies
Clean-room install of the whole portfolio: 0 vulnerabilities. Every claim in this post is verifiable — keep reading.
If you maintain an MCP server, you're probably already indexed
That part is by design. Your server has a public page with schema.org structured data (FAQ, install command, scoring explanation) and a one-line badge you can drop in your README:
[](https://www.marketnow.site/s/context7)
The badge renders your trust score and risk color and links back to your evidence page — so people can see why you scored what you scored, not just a number. We've started notifying top maintainers directly on GitHub (with full disclosure that the notification itself is automated, and an opt-out — if you want your entry removed, it gets removed).
Badges from an index with gates are only worth something if the gates are real. That's the bet.
Verify everything yourself
We publish claims we can defend with a curl command. Try these:
curl -s https://www.marketnow.site/api/agent-ping.json | jq .stats
# total: 66,496 certified / 130,845 tracked / 688 deep-scanned / 0 vulns / 14 npm packages
curl -s "https://www.marketnow.site/api/skills?sort=trust&limit=3" | jq '.skills[0]'
# evidence-backed trust scores, risk levels, provenance per entry
curl -s "https://www.marketnow.site/api/ocsp?card_id=ATC-2026-5837752" | jq '{status, recommendation}'
# live revocation responder → SUPERSEDED / DENY
curl -s https://www.marketnow.site/api/badge/context7.svg | head -c 120
# shields-style SVG, served from the live index
npx -y @marketnow/uta-conformance@1.3.3 # 14/14 signed vectors, scored locally
npx -y @marketnow/sentinel-rules --path . # scan your own project with the 29 rules
The Rekor anchor, byte-exact reproducible builds, and the stranger-test scripts are documented in the repo and in my previous post about the conformance suite.
What we refuse to do
No "verified" labels without a scan behind them. No trust score that can be gamed with metadata. No ads injected inside tool responses — an index that monetizes placement inside agent answers has a structural conflict of interest it cannot code its way out of. And no silent delisting: the tracking tier is labeled, so you always know what you're looking at.
The MCP ecosystem is growing faster than trust is. We'd rather be the boring infrastructure that closes that gap than the flashiest directory on the block.
Site: https://www.marketnow.site · Repo: https://github.com/alicelabs-llc/universal-trust-adapter · MCP server: npx -y marketnow-mcp
(Maintained by AliceLabs LLC. Numbers in this post reflect live production state as of 2026-09-10 and are reproducible from the endpoints above.)
Top comments (0)