Docs

1. Open the server’s page and pick your client in the Install box.

2. Copy the line shown there and run it in a terminal, or paste it into the file it names.

3. Fill in any API keys it asks for, then restart the client.

Note: if the line names mcprush, the server is behind our gateway and needs a key (next entry).

1. Sign up and confirm your email.

2. In Dashboard → Access, click Issue a key (choose Read and write if the server’s tools write, or to change your spending cap from the terminal) and copy it. It is shown once.

3. Run npx mcprush@latest login (needs Node 20+) and paste the key.

4. Run the command below with the server’s name, then restart the client.

Note: keys last a year; revoke one in Access. In CI, set MCPRUSH_KEY instead of logging in.

Add --client with claude-desktop, cursor, vscode, zed, devin or windsurf. add prints the file it wrote (VS Code: .vscode/mcp.json in the current folder).

Other clients: add --client <id> prints that client’s own command or config snippet to paste. npx mcprush@latest clients lists them all.

Note: For Claude Desktop, add writes an entry that starts mcp-remote, a bridge to our gateway, so Node.js has to be installed. An entry under the same name that add did not write is kept unless you add --force.

The entry holds the gateway address and your key. VS Code asks for the key once and keeps it out of the file. The file is readable only by you; the old copy is kept as .bak. Zed’s file is edited in place instead, and gets a .bak only when an entry this tool did not write is replaced.

Undo with npx mcprush@latest remove <server>, with the same --client you used for add. It also deletes the variables you saved for it, so an install that has them is removed only with a write key, or in Dashboard → In use. A server paid monthly is cancelled there instead.

Note: if another client still has the entry and your key, calling a free server adds it back to your account. Remove it on every machine, or revoke the key.

No account: browsing, installing a server from the line on its page, adding a free skill.

Account needed: servers behind our gateway (with a confirmed email), anything paid, the playground, spending caps, release alerts.

Runs on your own machine, connected straight to its publisher or no verified endpoint: copy the line from the server’s page instead.

An agent skill: use skill add.

A paid listing: buy it at the link it prints. After that, add works on any machine.

Confirm the address: confirm your email first.

Every entry needs your key from Dashboard → Access, or the gateway answers 401.

Claude Code: set MCPRUSH_KEY to your key, then run the claude mcp add line from the Install box.

Cursor: Settings → MCP → Add new global MCP server; paste the JSON below with your key in place of <your key>.

VS Code: run npx mcprush@latest add <server> --client vscode. It keeps the key out of the file.

Claude Desktop: paste the entry from the Installation tab into claude_desktop_config.json, with your key in place of <your key>. It starts mcp-remote, a bridge to the gateway, so Node.js has to be installed. From CLI 0.2.0, npx mcprush@latest add <server> --client claude-desktop writes the same entry for you.

Other clients: the Installation tab on the server’s page has the exact entry.

Behind our gateway you always get the current release; a pin can’t hold an older one. Tools a release adds stay blocked for you until you click Accept in Dashboard → Changes.

npm and PyPI servers: in the Versions tab choose Pinned to … or Roll back, then copy the install line again. It now names that version.

Local package (npx, uvx, docker): runs on your machine. No account needed.

Remote URL: your client calls the publisher directly. No account needed.

Behind our gateway (the line names mcprush): calls carry your key; plans, limits, billing and the playground apply.

Tools lists every tool; tick Only tools that write or reach the network for the risky ones. Security shows the scanner’s trust grade (A–F) and capability level.

Behind our gateway, tools that write need a Read and write key.

1. Add servers to a list with Add to a list on their pages.

2. Run the command under Install the whole list (or the one below), then restart the client.

Note: only free or bought servers behind our gateway are installed; add the others from their pages. Every seat on the account sees its lists.

1. Sign in and open the server’s Playground tab (or Dashboard → Playground).

2. Pick a tool, edit the example arguments, and click Run it.

Note: running a free server’s tool installs it on your account; a paid one must be bought first. Tools that write are refused. 50 calls a month on Free, unlimited on Pro.

1. Open Dashboard → Variables, fill in the fields for that install, and click Save.

2. Call the server. An empty required field is the usual cause of an authorisation error.

The value is stored encrypted, never shown in full again, and sent only to that server. For local or remote servers, put the key in your own client config instead.

1. Open the skill’s page and pick your client under Install.

2. Copy the line and run it in your project folder. Restart the client if the skill doesn’t show up.

Or use the CLI below: add --client cursor (vscode, zed, windsurf, codex…) for other editors, --global for every project. Remove with npx mcprush@latest skill remove <skill> (same flags) or by deleting the folder.

Note: a paid skill needs a purchase and your key. Nothing runs at install.

1. On the skill’s page, pick Claude Desktop under Install and run the line. It downloads a zip.

2. In Claude Desktop, open Customize › Skills and upload it.

Note: skill add --client claude-desktop writes nothing: Claude Desktop reads no skills folder, so the command prints this same zip address instead.

The model always sees each skill’s name and description, and loads SKILL.md and its files only when a request matches.

If a skill never fires, its description probably doesn’t match how you ask.

The weight on each card is SKILL.md plus reference text, without scripts. You pay it each time the skill loads.

Filter the catalogue by context; the tray adds up your picks against a 200k-token window.

A skill uses your client’s own tools (files, web, shell), its own scripts, or an MCP server you install separately.

Check What it asks for and Servers it uses on the skill page before installing.

Each member says why it was picked. You pay each member’s normal price; a stack is not a discount.

Most members are open-source servers that run on your machine, plus free skills. Those need no account.

No account: on the stack page, pick your client under Install, part by part and run or paste each line.

With a key: the command below writes every server it can into your client’s config. It skips skills and paid members you haven’t bought, and has no dry run.

Then add skills with skill add, fill in any API keys the servers need, and restart the client.

Copy a member’s line from Install, part by part on the stack page, or from its own page. Add skills with skill add.

Nothing links the members after install.

The stack page adds monthly plans and one-off licences (spread per month) into one total, the same figure checkout quotes.

Each paid subscription in it is billed on an invoice of its own on your billing day; a one-off is charged when it is bought. Free members add nothing.

Checks run in this order. The first failure answers; the call is not forwarded or counted.

1 · Key missing, revoked or expired → 401. Get one: Dashboard → Access → Issue a key; send it as Authorization: Bearer. A publisher key from Studio does not work here.

2 · Listing unknown or off the catalogue → 404; frozen → 403; no verified endpoint yet → 503; a public server you install from its own source → 400 (use the command on its page).

3 · Install missing on a paid listing → 403: buy it first. A free listing installs on its first call. Paused, or cancelled past the paid period → 403.

4 · Endpoint held for 60 seconds after 3 failures in a row → 503. Timeouts and errors on one installation’s calls alone don’t hold it.

5 · Rate over 3 tool calls a second on Free, 20 on Pro → 429. Retry in 1 second.

6 · Tool not on the listing, a write on a read-only key, or added in a release and not accepted yet (Dashboard → Changes → Accept) → a JSON-RPC error naming the reason.

7 · Monthly limits used up — your monthly call limit (50,000 on Free, 20,000,000 on Pro), the plan’s allowance or its calls-a-minute → 429.

Also: the body must be one JSON-RPC request (400) of at most 256 KiB (413).

Counts: a tools/call the server answered with 2xx. It uses one call of the plan’s allowance and of your monthly call limit.

Doesn’t count: initialize, tools/list, ping; any 4xx or 5xx; a JSON answer with a JSON-RPC error or isError: true; any refused call.

You pay only the subscription price. Counters reset on the 1st at 00:00 UTC; see them in Dashboard → Usage.

Price: your subscription keeps the price you bought it at. New prices apply to new buyers.

New write or network tools (or tools that gain that reach) are refused until someone accepts them: Dashboard → Changes → Accept. To accept them automatically: Settings → Apply updates automatically → Always · permissions included.

Everything else applies at once: new read-only tools, removed tools and new code. A version pin does not hold back a gateway listing.

Every price, invoice and payout is in USD. Your card issuer handles any conversion.

Invoices come from mcprush.com, not from publishers. Publishers never see your card.

Sales tax or VAT is added where it applies.

Card fees are not added for you; the publisher pays them.

1. Open Dashboard → Limits (owner or billing manager).

2. Set Hard cap for the account: the most your subscriptions may total a month. Default $1,000.

3. Set Warn me at: a banner shows once the month passes it. Default $800.

Also on by default: Settings → Budget cap on a new paid install, per cycle ($500 — a plan above it is refused until you raise it; 0 turns it off); Team → Org policy → Spend cap per seat ($1,500).

From the terminal, with a write key issued by the owner or a billing manager (the alert is a % of the cap):

Call limit: 429 with JSON-RPC error -32003 naming the limit; nothing is queued or charged. More calls: Dashboard → Plan → Pro (50,000 → 20,000,000 a month).

Spending cap: only a new purchase is refused, at checkout. Servers you already pay for keep running.

A new subscription charges nothing at checkout. Its first invoice comes on your billing day and carries the rest of the cycle it started in and the month ahead; every later invoice carries the month ahead. A trial is billed on the day it ends. A one-time purchase is charged at checkout through a Stripe invoice of its own; one paid from your balance is a line under Balance.

Invoices: Dashboard → Billing → Invoices. Stripe raises every one of them: Open is Stripe’s page for it and PDF is Stripe’s PDF. What each subscription takes next, and when, is under Next charge in In use.

To stop: Dashboard → In use → Manage, then:

Cancel the subscription — runs to the end of its period. Cancelled before its first invoice, it gets a last one that day for the days it was in use, and nothing after; that charge is fully refundable within 14 days.

Pause it — tools stop; nothing is billed while it is paused. No refund for days already paid. If the pause covered a renewal, Resume it invoices the rest of that period at once.

Uninstall — tools stop. Unused days of a period you have paid for are credited to your next invoice; before the first invoice, the days it was in use are invoiced now.

Free listing: never charged. Install it with the command on its page.

$0 tier: signed in, click Start on the free tier on the listing page. No card. Past its allowance, calls get 429 — never a bill.

Paid tier: click Subscribe to go to checkout. Default caps refuse a plan over $500 a month: raise them first (Set a spending cap).

The terminal installs only free listings and ones you already bought; --plan is ignored.

1. In Studio, click New server and pick MCP server.

2. Choose your source: Git repo, npm, PyPI, Container or Hosted URL.

3. Hosting and connection: You run it or We host it.

4. Create your listing, Set your pricing, then Prove ownership of the source — the same ways a listing is claimed: sign in with GitHub, a verification file in the repository, a token in the package release, or your domain. A private repo read through the GitHub App is proved by it, for the person who linked the App.

5. Review and submit → Submit for review.

Skill: pick Agent skill in step 1, then Add your skill → Edit and check → Listing and pricing → Prove ownership (a skill from a repository) → Submit for review.

CI key: Studio → API keys → New key (mrp_live_…, shown once; save it as MCPRUSH_PUB_KEY). Read-only: /api/pub/whoami, /api/pub/listings, /api/pub/calls.

Windows PowerShell (the block below is for macOS and Linux): Invoke-RestMethod https://mcprush.com/api/pub/listings -Headers @{ Authorization = "Bearer $env:MCPRUSH_PUB_KEY" }

1. Choose your source → Git repo → Private repo.

2. Click Install the GitHub App and pick the repositories on GitHub.

3. Pick the repo and click Continue.

Prove ownership: installing the App on the repo also proves it is yours — only for the person who linked the App to your workspace. When you submit, we ask GitHub that they own the repo or are its admin or maintainer; if not, someone who is links the App on Choose your source.

The App reads Contents and Metadata only. Revoking it stops our reads; the listing keeps working.

Note: if the wizard says Private repositories are off for now, use a public repo, a package or a Hosted URL.

1. Click Submit for review. Nothing is public yet.

2. The decision (live, changes requested or rejected) comes by email to your team and in Studio.

3. Changes requested: fix what the note says and submit again.

Common reasons: a description that doesn’t match the tool, a wrong reach, text about another product, a write the listing never mentions.

Final, no appeal (terms §6.4): a description that tells the model to do more than the tool does.

Stripe is not needed to go live; only your payouts wait for it. We don’t review later releases.

1. Annotate each tool: readOnlyHint: false or destructiveHint: true → write; openWorldHint: true → network; otherwise read. Unannotated names like create_ or delete_ count as write.

2. To fix one in the wizard: Manifest is not where we looked? → Enter the tools by hand → Reach (never below the annotations).

3. Describe every write tool in What it does; release checks flag one without.

A read-only key can’t call write tools, and new write or network tools wait for each buyer’s OK.

A plan: Plan name, Per month in USD, Calls a month, optional Rate limit per minute. Up to 8 plans. Past a plan’s calls, buyers get 429 — never an extra charge.

Paid prices: $5–$999. A $0 plan is your free tier. Optional: Offer a free trial of 7, 14 or 30 days.

Change prices any time: Studio → Servers → Manage → Pricing. Existing subscriptions keep theirs.

Note: Stripe is not needed to go live. Your share waits with us until Stripe verifies you: Payouts & Stripe → Connect with Stripe.

1. Open Studio → Releases, click Add new release, pick MCP server.

2. Pick the Listing, a Version such as 1.4.0, and What changed.

3. Click Publish. We release what your endpoint’s tools/list returns; if it doesn’t answer, nothing ships.

The listing shows buyers which tools were added, removed or changed reach. Undo: Roll back.

Adds a write tool? It waits as awaiting approval until your team clicks Approve and publish; buyers then accept it in Changes.

Note: release checks (descriptions, deprecations, version) are advice only. With Settings → Publish a release as soon as it passes the scan off, a release waits as held: click Serve it again.

Hosted by us? Use Build, then release instead.

1. Studio → Payouts & Stripe → Connect with Stripe.

2. Once Stripe enables payouts, each Friday pays out sales older than 7 days (7–14 days after a sale; a purchase paid from a buyer’s balance, no earlier than 30 days after the last top-up credited to that balance before the sale was recorded).

Sooner: Revenue & payouts → Pay out now (1% fee).

Fees: 12% to mcprush, so you keep 88%. Stripe’s fee (2.9% + $0.30 per charge) and $15 per dispute come out of your share. No listing fee, no minimum, nothing on free listings.

Refunds take back your 88% of the refunded amount. Stripe’s fee is not returned.

Follow Connect your server, step by step: pick You run it, paste Your endpoint, click Verify (it fails and shows your token once), deploy the token, click Verify again.

Verify passes when the token is accepted, a request without it — or with a token that is not ours — gets 401 or 403, tools/list returns at least one tool, and 5 of 5 pings answer — within 17 seconds. Up to 6 runs a minute. A reviewer's approval runs the same check again, so keep the endpoint up while the listing is in review: if it fails then, the listing is not published.

Later: Studio → Servers → Manage → Connection → Rotate (new token) or Check and use (new address).

Only calls that pass every check reach you (What the gateway checks on every call). Refused calls never count against the buyer or as your failures.

3 failures in a row (a 5xx, no answer, or refusing our token) hold your endpoint for 60 seconds; Manage → Connection shows held. Failures of one buyer’s calls alone don’t: it takes a second buyer, a connection that fails, or refusing our token on initialize.

Each call carries the JSON-RPC body, your token, x-mcprush-listing, x-mcprush-install, MCP transport headers and the buyer’s X-Env-… values. Never who the buyer is. Full list, redirects, caps, sandbox calls and timeouts: Endpoint requirements and limits.

Buyers call https://mcprush.com/gw/<listing>/mcp with our key. We forward each call to your endpoint with a token your endpoint checks.

1. In Studio, click New server and pick MCP server. Choose a source — Git repo, npm, PyPI, Container or Hosted URL — fill it in and click Continue.

2. On Hosting and connection, choose You run it. For We host it, follow Hosting your server with us instead. A Hosted URL source skips this choice.

3. Set Authentication to how your service signs in its own users. Buyers see it; we still reach you only with our token, so an endpoint that demands OAuth from us fails.

4. Add the token check (code below): answer 401 or 403 to any request without our token.

5. Paste your https address into Your endpoint and click Verify. The first click fails by design: it creates your token and shows MCPRUSH_TOKEN=mgw_… once. Copy it.

6. Put it in your server’s environment, deploy, and click Verify again. Your code reads authorization: Bearer …? Switch How your endpoint reads the token first.

7. Finish Create your listing and Set your pricing, then click Submit for review. It goes live when a reviewer approves it.

Lost the token? Click Issue a new token in the wizard, or Rotate under Manage → Connection. The old one stops working at once.

Your keys stay yours. We send only our token and, for variables your manifest declares, each buyer’s own values as X-Env-… headers.

Hosted URL source. On Continue we read your address without a token. If it refuses, click Continue again and type the name and description; the tools fill in when Verify passes.

Verify. Six things have to hold:

1. initialize with our token comes back below 500, so we can reach you: https, a public IPv4 address, a valid certificate. Self-signed certificates, private addresses and IPv6-only hosts fail.

2. The same answer is below 400, so your check accepts the token.

3. A request without the token is answered 401 or 403.

4. A request carrying a token that is not ours is answered 401 or 403: your check compares the value, not just that one is there.

5. tools/list with the token declares at least one tool and fits in 2 MiB.

6. All 5 pings come back below 500.

The check sends 9 requests: initialize and tools/list with the token, one tools/list without it and one with a made-up token, then 5 pings; a session server is sent 10. Each request waits 5 seconds, the whole check has to finish inside 17, and it can be run 6 times a minute. The initialize declares protocol version 2025-06-18.

To change the address later, use Check and use under Manage → Connection. A failed check changes nothing: calls keep going to the old address. Re-checking the address already in use is different: if it answers but fails (one missed ping is forgiven), it is no longer verified and buyers get 503 until it passes again.

The request. Each buyer call is one POST to your URL exactly as written: path and query kept, no /mcp added, no GET stream, no DELETE. The body is the buyer’s JSON-RPC request. Headers, and nothing else:

• host, accept, content-type, content-length.

• user-agent: mcprush-verify/1.0 (+https://mcprush.com), on buyer calls and on Verify alike.

• x-mcprush-token: your token — or authorization: Bearer … if you picked that under How your endpoint reads the token.

• x-mcprush-listing: the listing id. x-mcprush-install: one stable id per installation. Nothing identifies the buyer.

• mcp-protocol-version, last-event-id, mcp-session-id: when the buyer’s client sends them. A session id only from the installation it was issued to.

• X-Env-…: the buyer’s value for each variable the listing declares. API_KEY arrives as X-Env-API-KEY.

Calls without a buyer: Verify; Studio sandbox calls (x-mcprush-sandbox: 1); initialize and tools/list when you cut or promote a release; a GET without the token about every 6 days from mcprush-revalidate/1 — any answer below 500 is fine.

What the buyer gets. Your status and body, plus x-mcprush-ms and cache-control: no-store. Only two of your headers come back: mcp-protocol-version, and mcp-session-id on a successful answer to initialize. Start an SSE answer with event: so it goes out as text/event-stream. Your 401 or 403 reaches the buyer as our 500.

Limits. Nothing refused or held is billed.

• Answer: at most 256 KiB — 2 MiB when the call is tools/list. An answer over the cap is not cut: the buyer gets a 502.

• Request: over 256 KiB, or a batch, is refused before it reaches you.

• Time: 30 seconds per hop of silence (any byte resets it), and 44 seconds from the moment the call reached us for the whole call, redirects included. Answer once and end the response; a stream kept open is cut.

• Redirects: up to 3 redirects, each with its own 30 seconds, https only. Another host, port or scheme gets no headers of ours.

• No retries: any answer, even an error, is final.

• Circuit: 3 failures in a row — no answer, an answer of 500 and above, a 401 or a 403 — hold calls for 60 seconds. Then any other answer below 500 clears it. Failures of one installation’s calls alone don’t hold it: it takes a second installation, a connection that fails, or a 401 or 403 to initialize.

Tools. A tools/call is refused before it reaches you if the tool is not on the listing, writes on a read-only key, or came in a release the buyer has not accepted. To add a tool, cut a release.

Token. Starts with mgw_ and is shown once. Later Studio shows its first twelve characters under Manage → Connection → Your token. Rotate there switches at once: until you deploy the new value, buyers get a 500, and three in a row trip the circuit if one of them was an initialize or they came from two installations.

If Verify fails

• Nothing is listening on … at that port, … does not resolve, The certificate on … has expired, The certificate on … did not check out: fix the address, DNS or certificate (valid for that hostname).

• … accepted the connection but did not answer in time or The endpoint did not answer inside … seconds: answer each request within 5 seconds.

• Any other sentence naming your host, its certificate or a time limit: nothing answered at all. Check the address, DNS (a public IPv4 address), certificate and firewall.

• We could not reach it. initialize answered 500 or worse. Check your logs.

• It refused our own token. Your check reads another header or value, or the URL is not the MCP endpoint.

• It answered a request that carried no token instead of refusing it. Add the token check.

• It answered a request carrying a made-up token instead of refusing it: your check accepts any token. Compare it with the exact value we gave you and answer 401 to anything else.

• It answered, and it declared no tools. Return your tools from tools/list to a request carrying the token.

• It answered tools/list with more than 2 MB: trim the descriptions or split the server.

• It answered … of 5 plain pings with an error or not at all. Make it answer steadily.

Note: Calls are not signed. The token is the only proof they come from us.

What we read. GitHub only, at HEAD of the default branch; a branch or commit in the address is ignored. Public: raw.githubusercontent.com. Private: api.github.com through our GitHub App. Other hosts: use a Hosted URL source or type the fields.

Manifest. The first valid of: your Path to the manifest, server.json, .well-known/mcp/server.json, mcp.json, .mcp.json, server-card.json, package.json. It fills the name, description, tags and variables; buyers fill the variables in, and you get them as X-Env-… headers.

Tools. From the remote the manifest names, else from tool declarations in your code, else from your endpoint after Verify.

Every field stays editable and is never re-read. We still re-scan the repository for the security grade and notice if it is archived, renamed or deleted.

You run it:

1. Serve it over the MCP SDK’s Streamable HTTP transport on a public https address. Stdio alone will not do.

2. Add the token check below. It reads MCPRUSH_TOKEN from the environment.

3. Click Verify and follow steps 5–7 of Connect your server. The first click gives you the token.

Or pick We host it and we build this repository (your Dockerfile, Node.js or Python): Hosting your server with us.

What we read. registry.npmjs.org/<package>/latest — name, description, keywords, version, mcpName — then the GitHub repository it names, read like a Git source: public only, no manifest path, repository.directory first in a monorepo. The tarball is never downloaded.

Tools. From that repository (its manifest’s remote or its code), else from your endpoint after Verify. Manifest variables become buyer-filled X-Env-… headers.

No bin and no other sign of MCP? You get This does not look like an MCP server; click Continue again to go on.

You run it:

1. Serve it over the MCP SDK’s Streamable HTTP transport on a public https address. Stdio alone will not do.

2. Add the token check below. It reads MCPRUSH_TOKEN from the environment.

3. Click Verify and follow steps 5–7 of Connect your server. The first click gives you the token.

Or pick We host it (Node.js or your Dockerfile): Hosting your server with us.

What we read. pypi.org/pypi/<project>/json — name, summary, keywords, latest version — then the GitHub repository in the first project link labelled Source, Repository, Code or GitHub, else the Home-page field. It is read like a Git source: public only, no manifest path; a /tree/<branch>/<folder> link picks a monorepo folder.

Nothing is installed, imported or run. At most we read the wheel’s entry_points.txt for its console scripts.

Tools. From that repository (its manifest’s remote or its code), else from your endpoint after Verify. Manifest variables become buyer-filled X-Env-… headers.

No console script and no other sign of MCP? You get This does not look like an MCP server; click Continue again to go on.

You run it:

1. Serve the Python MCP SDK’s Streamable HTTP app, streamable_http_app(), on a public https address, for example with uvicorn server:app. In mcp 2.x the server class is MCPServer, from mcp.server.mcpserver. Stdio alone will not do.

2. Add the token check below, a middleware in front of the app. It reads MCPRUSH_TOKEN from the environment.

3. Click Verify and follow steps 5–7 of Connect your server. The first click gives you the token.

Or pick We host it (Python 3.12 or your Dockerfile): Hosting your server with us.

What we read. Only registry.modelcontextprotocol.io, searched for the last segment of the image name, without host, namespace or tag. A record counts only if it lists this image; its server.json fills the fields and its https remote gives the tools. The image is not pulled.

Not in the registry? The name is the last segment, you write the description, and the tools fill in after Verify.

You run it:

1. Run the container on your Linux host with TLS in front (a certificate for the endpoint’s hostname) and the token in its environment, as in the code below. A stdio-only image needs an HTTP bridge.

2. Make the server inside refuse any request without our token (401 or 403). We ship no sidecar.

3. Click Verify and follow steps 5–7 of Connect your server. The first click gives you the token.

Or pick We host it: we pull the pinned digest and run it, stdio too. See Hosting your server with us.

1. In Studio, click New server and pick MCP server, then a source: Git repo, npm, PyPI or Container.

2. In Hosting and connection, choose We host it. The default, You run it, means your own endpoint.

3. Fill in the build settings, click Build, and submit once it shows Built.

Either way, buyers get the same address and install command, and your share is the same.

Not offered for a Hosted URL source. To move a listing you run to us, or if We host it is disabled, ask support.

Limit: 8 hosted listings per account (see Hosting allowance); support can raise it.

Git repo (github.com): the latest commit on the default branch.

npm: the version tagged latest.

PyPI: the latest version, from its source distribution (sdist). No sdist, no build.

Container: the tag you gave in Image reference, fixed to its digest at each Build.

For Git repo, npm and PyPI you cannot pick a branch or version. To ship a fix, publish it (for a Container, push it under the same tag), then click Build again. If the source cannot be read, nothing is built.

Note: Private repositories are refused, even with the GitHub App. Images may come from any public registry. Limits: 250 MB unpacked source, 1024 MB image.

1. Build method: Repository Dockerfile, Node.js (Node 24, Alpine), Python (3.12, Alpine) or Existing container image (not rebuilt). Your source limits the choice.

2. Node.js or Python: set the Start command (e.g. node dist/server.js), and if needed an Install / build command and a Project directory. The whole repository is copied, so monorepos work. It runs as the non-root user mcprush.

3. Repository Dockerfile: set the Dockerfile path if it is not Dockerfile at the root. The build always runs from the root; Build context is currently ignored.

4. Transport: stdio or Streamable HTTP. For HTTP, set Listening port (default 8080) and MCP path (default /mcp), and listen on 0.0.0.0, not 127.0.0.1.

5. Click Build. If it fails, the end of your command’s output shows on the listing and arrives by email.

stdio works with Node.js, Python and an existing image (we add an adapter), not with your own Dockerfile.

Existing image, HTTP: the Start command is optional. It replaces CMD and runs after ENTRYPOINT, so give only the arguments, e.g. --transport streamable-http.

Existing image, stdio: the Start command is required and must be the full command, program included, e.g. mcp-server-fetch. The image’s ENTRYPOINT is not used, and its base must be Alpine or Debian.

Note: Start commands are split on spaces; quotes do not work.

Limits: image up to 1024 MB, 15 minutes per build, one build at a time per listing and per publisher. Builds are free.

New listing: submit a fresh build. It goes live when the reviewer approves.

1. For a live listing, open Studio → Servers, click Manage on your server, then Versions on the Hosting row, and click Build a new version.

2. Wait for Built. Buyers stay on the current release; a failed build never replaces it.

3. Click Release it. Each buyer’s next call starts the new image (a few seconds of “The server is starting”), and buyers see a row in Changes.

Built goes stale if you change the settings, the source moves, or variables or secrets change. Build again before you submit.

Note: There is no rollback button yet; ask support to go back to an earlier build. During review, only the submitted build can be released.

Per buyer: each installation runs in its own container, with no shared process, disk or secrets. It answers at the listing’s usual gateway address.

On demand: the first call starts it and gets “The server is starting. Try again in a few seconds” (not billed). It stops after 15 minutes without calls. There is no always-on mode.

No persistent disk: each start is a fresh image. Keep data in your own database or storage; listings that need local files or SQLite are refused.

Sizes: Starter (0.25 vCPU / 0.5 GB) is open to everyone. Standard (0.5 / 1 GB) and Large (1 / 2 GB): ask support to open them.

Secrets are stored encrypted and never shown again.

Limits: 8 running containers per publisher, 20 in total. Past that, buyers get “This publisher is at its task ceiling”.

Crashes: a container that exits right after start is not retried for 10 minutes, unless you release a new build.

Not yet: custom domains, other regions, runtime logs (you only see failed-build output).

1. Open Dashboard → Access and click Issue a key.

2. Name it after the machine it lives on, so you can revoke it alone. Pick the Client (a label only).

3. Under What it may call, keep Read-only tools, or pick Read and write if the agent must write.

4. Click Issue the key and copy it (mcpr_…). It is shown once.

5. Save it with export MCPRUSH_KEY=… (Windows PowerShell: $env:MCPRUSH_KEY = "…", or setx MCPRUSH_KEY … for new terminals), or run npx mcprush@latest login for the CLI, and test it with the call below.

Note: Read-only keys can’t call write tools. Keys expire after a year. Revoking stops a key at the next call; installs stay.

Windows PowerShell (the block below is for macOS and Linux): Invoke-RestMethod -Method Post -Uri https://mcprush.com/gw/cookwala-mcp/mcp -Headers @{ Authorization = "Bearer $env:MCPRUSH_KEY"; Accept = 'application/json, text/event-stream' } -ContentType 'application/json' -Body '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

1. Check that the server is behind our gateway: its page says “called through our gateway” or “Hosted here, behind our gateway”. A page that says “not connected yet” gets 404 here when its publisher has put no endpoint behind it, and 503 while that endpoint is not verified; one that says “no running release yet” is hosted here and gets 503 until a release is live. Other servers install from their own source and get 400 here.

2. Buy it first if it is paid. A free one is installed by your first call.

3. Point any Streamable HTTP MCP client at https://mcprush.com/gw/<server>/mcp with the header Authorization: Bearer $MCPRUSH_KEY.

Limits: 3 tool calls a second on Free, 20 on Pro; 50,000 calls a month on Free, 20,000,000 on Pro; plus the plan you chose for that server. Request body up to 256 KiB.

Errors: 400 not one JSON-RPC request (send content-type: application/json) · 401 key missing, revoked or expired · 403 not bought or paused · 404 unknown server, or one not connected to the gateway · 413 body over 256 KiB · 429 over a limit, see Retry-After (for a monthly limit, the start of next month) · 503 its endpoint is not verified yet, it is hosted here with no running release yet, or it is starting or briefly unavailable; retry when Retry-After is sent. A write on a read-only key, or a tool you haven’t accepted, is refused with a JSON-RPC error.

1. Run the download command from the skill’s page, or the one below (macOS, Linux or PowerShell 7.4+) with the skill’s id. Files unpack into a folder named after the skill.

2. Read them first: some skills include scripts your agent may run.

3. Point your runtime at the folder.

Shortcut: npx mcprush@latest skill add <publisher>/<skill> does all of this.

Free skills need no key. Paid skills need your key and a purchase: without a key 401, without the purchase 403, and both carry the checkout link.

Paid skill: put -H "Authorization: Bearer $MCPRUSH_KEY" before the | in the command below. If it stops at 401 or 403, run the same curl on its own without -f: the answer says why, with the checkout link when a purchase is what’s missing.

Also: bundle.zip and skill.md (add ?v=1.2.0 for an older version) under /api/skills/<id>/.

Errors: 401 no key, or a key that is not live · 403 not bought yet · 404 unknown skill · 409 no files, or its source is gone (retrying will not help) · 429 too many requests or skill folders from one network, see Retry-After · 503 source briefly unreachable, see Retry-After.

https://mcprush.com/gw/echo answers initialize, tools/list, ping and one tool, echo. Send your listing’s gateway token or the public demo token mcprush-demo; any other token, or none, gets 401.

1. In Studio, click New server, pick MCP server, then Hosted URL, and enter that address.

2. In Hosting and connection, check that Your endpoint holds it and click Verify.

3. Click Save and finish later. When your server is ready, swap in its address and click Verify again.

Note: 2,000 requests a minute.

Windows PowerShell (the block below is for macOS and Linux): Invoke-RestMethod -Method Post -Uri https://mcprush.com/gw/echo -Headers @{ 'x-mcprush-token' = 'mcprush-demo' } -ContentType 'application/json' -Body '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"echo","arguments":{"text":"hi"}}}'

What: MCP Trust Checker looks for injected instructions, hidden characters, hardcoded secrets, supply-chain risks and what each tool can reach.

When: after the listing goes live (a new one may show “not scanned” for a while), and again for each new version.

Which: servers with an npm, PyPI or GitHub source. Remote URLs, container images and skills are not scanned.

Results are on the server’s Security tab. They never block a listing.

Note: The check mark by a name is about the publisher or the endpoint, not the scan.

Bands: A 90+ · B 80+ · C 70+ · D 60+ · F below 60.

Score: threat findings set the base. Then up to 10 points come off for what the tools can reach, up to 5 for an unverifiable source, and up to 25 for a shallow scan.

Caps: one confirmed high finding — C at best; two — D; any critical — D; a confirmed critical — F.

No letter means not scanned. The Security tab shows every finding and the arithmetic.

A release that adds, removes or widens a tool creates a row in Dashboard → Changes.

1. Open Changes and read what changed.

2. Click Accept to allow the new tools. To keep them blocked, do nothing or click Hold: calls to them are refused until someone accepts, and everything else works. A held row keeps its Accept button.

Auto-accept: set Settings → Apply updates automatically to Always · permissions included (default: Safe only).

Note: Tool description edits are not tracked.

The marketplace does not filter server output and cannot see what a server does inside.

1. Give agents a Read-only tools key: write tools are refused.

2. Keep Apply updates automatically on Safe only, so new write tools wait in Changes until you accept them.

3. On the server’s Security tab, check the capability tags and the Toxic-flow graph (where untrusted input can reach your data or the web).

4. In your agent, ask a human before any write tool runs.

1. Open Dashboard → Access.

2. Read Blast radius (tools reachable, can write, reach the internet) and Who grants what (per server).

3. To shrink it, pause or uninstall a server, or use a read-only key.

Org policy (Team → Org policy) can allow only verified publishers. It cannot block a capability.

Note: Revoking a key does not remove installs; paid ones keep billing.