Changelog

Tester, verification and Monitor package checks now run in disposable containers on a dedicated worker, separate from the directory application. Private networks, cloud metadata services and peer containers are blocked. Each job has resource limits, and execution is refused if the isolation policy changes or acceptance is missing.

We tested the protections on the deployed worker and repeated acceptance after a reboot. Public web access remains available. A passing handshake confirms startup and tool discovery, not that a package is free of malware or that every tool works. The new guide explains the safeguards, credential handling and what the results mean for your own setup.

Every claimed and verified server now gets a weekly static scan of its repository, shown on the server page as a security profile. The profile lists what the code reaches: network hosts, environment variables, shell and dynamic code execution, credential and agent configuration files, persistence and similar capabilities, each with a count and where we found it. From that we state an exposure level of minimal, limited, broad or extensive. It describes what the server opens up, not the maintainer; a server may need broad access to do its job. Owners see file and line examples and dependency advisories on their dashboard.

Maintainer plans and company placements used to share one page. /pricing now shows the three maintainer plans side by side: Free, Pro at $19 per year and Monitor at $59 per year, with a comparison table and the launch cohort status. Pro checkout stays paused while the cohort is open so nobody pays for a badge waiver they do not need. /advertise carries the three placements for companies with their own checkout. Prices are unchanged.

Every Python server failed verification with exit code 126 regardless of its command, because uv and uvx were never installed on the verifier host. They now run inside the sandbox, with their tool and interpreter directories kept within it, and the sandbox memory ceiling was raised so uv's downloader no longer aborts. We confirmed the fix with a uvx handshake that returned its tools; the npx path is unchanged. If your Python server failed before September 2, save your listing once to queue a fresh run.

Most claimed servers were never testable because the verifier only ran commands that already began with npx or uvx. It now derives a launch command from the install instructions: pip, pipx and uv tool installs become uvx, npm, pnpm and yarn installs become npx, and a bare https URL runs through mcp-remote. Docker and multi-step installs are reported as blockers instead of failing silently. Servers that need credentials can store KEY=value pairs on the edit page; values are encrypted with AES-256-GCM, never returned to the browser and injected only into the sandboxed process. The dashboard checklist shows the derived command and the last failure reason in plain language.

Paste an npx or uvx command, an npm package name or a GitHub repository into /test and we run the same sandboxed MCP handshake as our verifier, usually in about 30 seconds. You get a permanent report page with the tools the server exposed, a plain-language diagnosis when it fails and the tail of stderr. Anonymous visitors get three runs a day and signed-in users get fifteen; repeated commands are served from a 24 hour cache. Passing reports are public and indexable, failing ones are not.

Monitor runs a real MCP handshake against up to 5 of your claimed servers every day. The first check sets a silent baseline. After that we email you only when something changes: the server stops responding, it recovers, or its tool list drifts. Every monitored server gets a public status page at /status/{slug} with a 90 day uptime strip, the last check facts and an incident log. Monitor is $59 per year or $7 per month, excluding tax, and includes Pro.

Claiming a server, or saving an edit on one you own, now queues it for the nightly verification run whenever the recorded npx or uvx command is runnable. There is no separate request button to find. If a run fails, saving a corrected command re-queues it. While the launch cohort is open this applies to everyone, and the first 100 verified servers keep a permanent exemption from the badge requirement. After the cohort fills, automatic runs are for Pro accounts and servers that already show the badge; everyone else keeps the manual request path.

Each server page now links to a health report at /servers/{slug}/health. It lists the timestamped evidence we hold about the server: repository freshness, whether the install command is runnable, the last handshake result, badge presence, authentication method and client compatibility, each with its source and the time we observed it. The report also states its limits. It is not a security audit, and a successful handshake shows that MCP initialization worked at that time, nothing more. Every report has a shareable image card.

Pro is now a single account-wide subscription instead of a per-server purchase. One $19 per year payment applies to every server you own. Pro keeps a verified server's status without embedding the MCPVault badge in your README or on your site, highlights your listings with a Pro chip, and keeps the do-follow website link that comes with being verified. It never replaces the live handshake: a server still has to pass verification to be shown as verified.

The directory, server pages, docs, pricing, claim and submit flows, dashboard and account pages are now available in Japanese at /ja and in Simplified Chinese at /zh. Japanese went live on August 18 and Chinese followed a day later. Blog posts, privacy and terms stay in English. Every translated page links to its counterparts in the other two languages, and the language switcher sits in the header and the footer.

/pulse is a public activity page built from the same pipeline data we use internally: recently verified servers, recent claims, new arrivals and the ingest log. It refreshes every five minutes. The homepage carries a short strip of the same activity, and a weekly Vault Report goes out to newsletter subscribers with the same numbers.

Companies can now buy a labelled placement without emailing us: a featured listing at $29 per month, a category placement at $99 per month or a sitewide placement at $299 per month, paid through Stripe and activated as soon as the payment clears. Featured servers are pinned with a visible badge so readers can tell paid placement from earned position. Grades, verification results and directory order are not for sale and never change because of a placement.

A claimed server can now request verification. Our verifier spawns the server from its install command in a sandbox, runs a full MCP initialize and tools/list exchange, and records the outcome and the tools it saw. Servers that pass show as verified in the directory, get a do-follow link to their website and are re-checked weekly. Every listing also has a status-aware SVG badge in light and dark variants for READMEs and websites; free verification asks for that badge to be present.

We parse each indexed README for the tools the server exposes and now publish one page per tool under its server, for example /servers/some-server/tools/search. A tool page shows the tool's description, the parent server's install command and the other tools that server ships, and the server page links to its full tool list. Tool pages have their own sitemap, so a server can be found by what it does and not only by its name.

We index MCP servers from public GitHub repositories, so most maintainers already have a listing they never wrote. From today you can sign in with GitHub, claim any listing for a repository you have push access to, and correct the fields we got wrong: description, category, install command, logo and website. If your server is not in the vault yet, submit the repository and we ingest it with the same heuristics as the crawler, then hand it straight to the claim flow.