Add your MCP server to the registry
Once your package is listed, anyone who runs mcp-audit vet on it gets its facts before installing, lookalike names are flagged as typosquats, and you get a page here and a README badge.
What you get
mcp-audit vetreports your package's publisher, advisories and capabilities, offline.- Configs that name a lookalike of your package are flagged as typosquats.
- A page at
mcp-audit.dev/servers/<ecosystem>/<slug>/and a JSON verdict. - A shields.io badge that updates when the registry does.
mcp-audit vet <package> --badgeprints the markdown.
What can be listed
- A public MCP server package on npm or PyPI, the two ecosystems
vetcan resolve. - With a known maintainer or organisation, and not malicious or abandoned.
- Hosted-only servers (a URL with no installable package) are out of scope: there is nothing
vetcould resolve, hash or pin. List those in the official MCP Registry.
What the form asks
| Field | Required | Notes |
|---|---|---|
| Package name | Yes | The exact package name as published. |
| Package ecosystem | Yes | Where the package is published. Choices: npm, pypi or other (describe in notes). |
| Repository URL | Yes | Public GitHub or GitLab repository. |
| Maintainer or organization name | No | Shown on the verdict page. |
| What can this server do? | No | Check all that apply. Choices: read files on the user's machine, write or modify files on the user's machine, execute shell commands or run arbitrary code, make network requests or fetch content from the internet, query databases, handle credentials or secrets, send or read email, control a web browser, access git repositories or version history or access cloud resources (AWS, GCP, Azure, etc.). |
| Anything else we should know | No | CVEs that apply to a dependency but not this package specifically, verification links, maintainer contact, or anything else. |
You also confirm that:
- The package is publicly available on npm or PyPI.
- The repository is public.
- I am the maintainer or have authorization to submit this package.
Read from the submission form in the repository.
Listed or verified
Every accepted package is listed and protected against lookalikes. It is marked verified only with evidence that you control the package, such as a publishing account on your project's own domain, a comment from the publishing account on the issue, or an official MCP Registry entry that points both ways. A git commit email does not count. Most entries start as listed, and that is a normal outcome.
After you submit
A maintainer reviews the package and its capabilities from the source, adds it to registry/known-servers.json, and comments on your issue. We aim to review within 7 days. Your page and badge appear with the next site build. You can also open a pull request that edits the registry file directly.
The registry today
55 packages are listed, 26 with a verified publisher. 6 maintainers have listed their own servers so far; they are credited in the contributors list. Browse the registry.