Declare your MCP server's source repository

What we checked

We read your package manifest for a declared source repository URL and then tried to resolve it. The signal passes only when the URL is present, well-formed, on a recognised source-code host, and publicly reachable without redirects. Each way it can fall short (no URL declared, a malformed URL, a link that redirects elsewhere, an unreachable or sign-in-gated repository, an HTTP error, or a host we don’t recognise) is reported separately:

Repository check failed: no source repository is declared.

Repository check failed: the declared repository URL redirects; it must resolve directly.

Repository check failed: the declared repository URL couldn't be reached.

Repository check failed: the declared repository URL isn't a valid web address.

Repository check failed: the declared repository isn't on a recognized source-code host.

Declared repository URL returned an HTTP error

Repository check failed: the declared repository isn't publicly accessible.

Why it matters

The source repository is the anchor for almost everything else we verify. A reachable, public repo is how we (and your users) confirm the published artifact actually corresponds to auditable code, and it’s where we look for your lockfile, your license file, and your security policy. When the repo link is missing or broken, those checks come back inconclusive too, so a single bad URL quietly drags down several signals at once.

That makes a correctly declared repository one of the highest-leverage fixes available: it’s a one-line manifest change that lets the rest of the provenance checks run.

How to fix it

Declare a public, directly-reachable repository URL in your package manifest. Use the canonical https URL on a recognised host (e.g. GitHub or GitLab), make sure the repo is publicly readable, and avoid URLs that redirect. npm’s repository field docs cover the expected format. Pick your ecosystem:

{
"name": "your-mcp-server",
"repository": {
  "type": "git",
  "url": "git+https://github.com/your-org/your-mcp-server.git"
}
}

[project.urls]
Repository = "https://github.com/your-org/your-mcp-server"

<PropertyGroup>
<RepositoryUrl>https://github.com/your-org/your-mcp-server</RepositoryUrl>
<RepositoryType>git</RepositoryType>
</PropertyGroup>

// The module path doubles as the repository location.
// Host the code at exactly this path on a recognised host.
module github.com/your-org/your-mcp-server

go 1.22

[package]
name = "your-mcp-server"
repository = "https://github.com/your-org/your-mcp-server"

How we re-check

We re-resolve the declared URL on our next crawl of your package. Once it points directly to a public repository on a recognised host, the signal flips to verified on the following score refresh, and any lockfile, license, or security-policy checks that were pending on the repo can run.

Give this to your AI

Paste this into Claude Code (or any coding agent) from inside your server's repository. It states the failing signal, the outcome we re-check for, and the format the fix has to take.

Prompt

Context: this repository publishes an MCP server. VerifyMCP's repository
check failed, which means the declared source-repository URL in the
package manifest is missing, malformed, or does not resolve directly to a
public, recognised host.

Goal: the manifest declares a public, directly-reachable repository URL on
a recognised host (for example GitHub or GitLab), so the next crawl
records the repository as verified and the dependent lockfile, license,
and security-policy checks can run.

Do this:
1. Identify the package ecosystem (package.json, pyproject.toml, *.csproj,
   go.mod, Cargo.toml) and find the current repository declaration, if any.
2. Set the manifest field to the canonical https URL of the repository:
   `repository.url` in package.json, `[project.urls] Repository` in
   pyproject.toml, `<RepositoryUrl>`/`<RepositoryType>` in the .csproj, the
   `module` path in go.mod, or `repository` in Cargo.toml.
3. Confirm the repository is genuinely public: no login required to view
   it. If it is currently private, ask me before changing its visibility.
4. Open the exact URL from the manifest in a private/incognito browser
   window and confirm it loads directly, with no redirect and no sign-in
   prompt. If it redirects, update the manifest to the final URL.
5. Prepare the release, then stop and let me run the publish myself, since
   the check reads the published manifest.

Rules:
- Never run the publish command (`npm publish`, `twine upload`, `dotnet nuget
  push`, `cargo publish`, a release tag that triggers one) yourself. A
  published version is permanent and notifies every downstream consumer:
  prepare the change, show me the diff, and let me publish it.
- Do not point the manifest at a repository that is not the real source for
  this package; ask me first if you are unsure which one is canonical.
- Never make the repository public without asking me first; visibility is
  my decision, not yours.

Report back: the files you changed, the URL you declared, and confirmation
that it loads directly without a sign-in prompt or redirect.

Reference: https://verifymcp.io/docs/packages/repository