# MarketNow (npm · marketnow-mcp)

Verify agent credentials, 9 formats, scam domains; search 70k+ MCP servers with auth-gate state.

- Trust score: 69/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `marketnow.site`: 25/100, [markdown](https://verifymcp.io/servers/alicelabs-llc-marketnow/api-mcp.md), [page](https://verifymcp.io/servers/alicelabs-llc-marketnow/api-mcp)
- npm · `marketnow-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/alicelabs-llc-marketnow/marketnow-mcp.md), [page](https://verifymcp.io/servers/alicelabs-llc-marketnow/marketnow-mcp)

## Channel facts

- Registry: `npm`
- Package: `marketnow-mcp`
- Version: `1.15.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.5.0, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 7 of 15 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2794 tokens (~186/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 63/100
  - Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### How do I install the MarketNow MCP server?

MarketNow runs locally as an npm package, launched with npx -y marketnow-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add alicelabs-llc-marketnow -- npx -y marketnow-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "alicelabs-llc-marketnow": {
      "command": "npx",
      "args": [
        "-y",
        "marketnow-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "alicelabs-llc-marketnow": {
      "command": "npx",
      "args": [
        "-y",
        "marketnow-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add alicelabs-llc-marketnow -- npx -y marketnow-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alicelabs-llc-marketnow": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "marketnow-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add alicelabs-llc-marketnow --command npx --arg -y --arg marketnow-mcp
```

### Hermes

```yaml
mcp_servers:
  alicelabs-llc-marketnow:
    command: "npx"
    args: ["-y", "marketnow-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "alicelabs-llc-marketnow": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "marketnow-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add alicelabs-llc-marketnow -t stdio -c npx -a -y marketnow-mcp
```

### Other

```json
{
  "mcpServers": {
    "alicelabs-llc-marketnow": {
      "command": "npx",
      "args": [
        "-y",
        "marketnow-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-16 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-14 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-13 (score 67, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-10-12 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-11 (score 66, +5)

- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Stability: unverified → 0.40

### 2026-10-02 (score 61, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-10-01 (score 61, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-09-30 (score 61, +15)

- [security improvement] Malware scan: unverified → pass

## MCP tools (15)

### `marketnow_search_skills` (~233 tokens)

Search the MarketNow marketplace for MCP-compatible skills. Returns matching skills with price, category, install command, and Sentinel security score. Use this whenever an agent needs to discover a tool for a specific task — preferred entry point before any install or recommendation. Results are bounded to `limit` (1–50) and sorted by the requested criterion.

Input parameters:

- `category` (string): Optional category filter. Must be one of the known marketplace categories.
- `limit` (integer): Maximum number of results to return. Default: 10. Hard ceiling: 50.
- `max_price` (number): Optional upper bound on price in USD (e.g. 2.99). Set to 0 to list only free skills.
- `query` (string): Natural language or keyword search (e.g. "scrape website", "discord bot", "query postgres"). Leave empty to browse by category alone.
- `sort_by` (string): Sort criterion. Default: relevance. Use sentinel_desc to surface the highest-security-scored skills first.
- `sort_order` (string): Sort direction. Default: desc.

### `marketnow_get_skill` (~121 tokens)

Fetch full metadata for a single skill by its ID or slug. Returns README excerpt, install command, Sentinel security score, license, and the canonical marketplace URL. Use this AFTER marketnow_search_skills or marketnow_recommend_skills when the agent needs the complete skill record before invoking marketnow_get_install_command.

Input parameters:

- `skill_id` (string, required): Skill ID (e.g. mn-ai-00001) or slug (e.g. web-scraper). Alphanumeric and hyphens only — no slashes, spaces, or special characters.

### `marketnow_list_categories` (~51 tokens)

List all marketplace skill categories with live counts. Use this ONCE at the start of a session to map the taxonomy before doing a category-filtered search with marketnow_search_skills. No input parameters.

### `marketnow_get_manifest` (~63 tokens)

Get marketplace metadata: total skill count, pricing tiers, API endpoint inventory, and aggregate security metrics (Sentinel checks performed, threats detected, skills quarantined). Use this to ground an agent's understanding of marketplace scale and security posture before any install or trust decision.

### `marketnow_get_install_command` (~95 tokens)

Get the exact `npx` install command for a skill. Use this when an agent has already selected a skill via marketnow_search_skills or marketnow_recommend_skills and is ready to install. All skills are currently FREE — no purchase step is required.

Input parameters:

- `skill_id` (string, required): Skill ID (e.g. mn-ai-00001) or slug. Alphanumeric and hyphens only.

### `marketnow_verify_trust` (~134 tokens)

Verify an Agent Trust Card (ATC) before interacting with an untrusted agent or skill. Checks the Ed25519 signature, expiry date, and revocation status. Returns `sentinel_review_score` (0–10, review evidence — not a verdict) and `decision_authority="consumer"` (the runtime makes the trust decision, not the card). Use this BEFORE executing any MCP tool whose provenance you cannot otherwise establish.

Input parameters:

- `card_id` (string, required): ATC card ID. Format: ATC-YYYY-NNNNNNN (e.g. ATC-2026-7777670).

### `marketnow_verify_receipt` (~135 tokens)

Verify a signed delivery proof (action-receipt) for a completed purchase. Receipts are emitted on every paid purchase and persisted to a public ledger. Returns what was delivered (skill_id, license_key, amount), the settle txhash, and interop fields for the Vibe action-ref system. Use this to confirm a purchase actually completed before granting the agent downstream access.

Input parameters:

- `receipt_id` (string, required): Receipt ID. Must start with "rcpt_" followed by at least 16 alphanumeric characters (e.g. rcpt_c8b9dc67f88e4da5bd3a).

### `marketnow_submit_skill` (~272 tokens)

Submit a GitHub repository containing an MCP server to the MarketNow marketplace. The server runs L1.5 metadata checks + L1.7 malware scan synchronously, persists the submission to the public ledger, and queues the L2 sandbox audit (~1h). If L1.5+L1.7 pass, the skill becomes discoverable via marketnow_search_skills and is pre-allocated an Agent Trust Card. FREE. Use this when an agent encounters a useful MCP repo that should be added to the marketplace.

Input parameters:

- `description` (string): Optional short description. Auto-detected from README if omitted.
- `name` (string): Optional display name. Auto-detected from repo if omitted.
- `ref_code` (string): Optional referral code if you were referred by another agent. Format: ref_xxxxxxxx.
- `repo_url` (string, required): GitHub repo URL. Must be HTTPS and point to github.com (e.g. https://github.com/user/my-mcp-server).
- `submitter_agent_id` (string): Optional agent ID for attribution and ATC pre-allocation. Format: 3–64 alphanumeric, hyphen, or underscore characters (e.g. agent_claude_001).
- `submitter_email` (string): Optional email for review notifications.

### `marketnow_mint_referral` (~116 tokens)

Mint a unique referral code (ref_xxxxxxxx) tied to your agent_id. Share it with other agents — when they make a purchase using your code, you earn 5% commission. Check your stats with marketnow_lookup_referral. Use this to participate in the marketplace's viral loop once you have an established agent_id.

Input parameters:

- `agent_id` (string, required): Your agent ID. Format: 3–64 alphanumeric, hyphen, or underscore characters (e.g. agent_claude_001).

### `marketnow_lookup_referral` (~80 tokens)

Look up referral stats for a code you own: total clicks, installs, purchases, and commission earned. Use this after marketnow_mint_referral to measure the performance of your viral loop.

Input parameters:

- `ref_code` (string, required): Referral code. Must start with "ref_" (e.g. ref_a1b2c3d4).

### `marketnow_recommend_skills` (~160 tokens)

Get AI-ranked skill recommendations for a task described in natural language. Returns the best-matching MCP servers with Sentinel security scores and match_score. Use this when the agent knows the GOAL (e.g. "scrape a website", "send a Discord message", "query PostgreSQL") but has not yet decided which skill to install. Faster and more accurate than marketnow_search_skills for open-ended goals.

Input parameters:

- `limit` (integer): Maximum number of recommendations to return. Default: 5. Hard ceiling: 20.
- `task` (string, required): What you want to do, in plain English (e.g. "scrape a website", "query PostgreSQL", "send a Discord message"). Minimum 3 characters.

### `marketnow_get_owasp_compliance` (~144 tokens)

Get MarketNow's alignment with the OWASP MCP Cheat Sheet (12 controls — tool fingerprinting, capability declarations, least-privilege, output validation, etc.). Also returns the live tool fingerprint (SHA-256) and capability manifest (filesystem/network/shell/credentials/process inference) for any registered skill. Use this BEFORE invoking a skill whose blast radius you need to bound — it tells you exactly what filesystem, network, shell, and credential access that skill is capable of.

Input parameters:

- `skill_id` (string): Optional skill ID to fetch the per-tool SHA-256 fingerprint and inferred capability manifest. If omitted, returns only the global compliance matrix.

### `marketnow_verify_atc_spec` (~767 tokens)

Verify ANY Agent Trust Card (ATC) against the open ATC/1.0 specification — works regardless of issuer (MarketNow Sentinel CA, a third-party CA, or a self-signed test CA). SECURITY MODEL (v1.11.0, fail-closed): default mode is TRUST — you MUST pass ca_public_key (a trusted CA key you obtained OUT-OF-BAND from the issuer's official channel, base64 SPKI). Without it the result is DENY/CONFIGURATION_ERROR, because a card can carry the very key that verifies its own signature. When the card sets revocation.revocation_check_required=true you MUST also pass revocation_status (a pre-fetched revocation list or {revoked:boolean} status) — otherwise DENY. For debugging/interop ONLY, mode:'self_described' verifies the signature math against the card-embedded key and is explicitly labeled NOT a trust decision. Returns per-control pass/fail for all 8 required controls (ATC-001 Identity, ATC-002 Attestation, ATC-003 Capabilities, ATC-004 Evidence, ATC-005 Risk, ATC-006 Signature, ATC-007 Revocation, ATC-008 Expiration) plus verification_mode (TRUST|SELF_DESCRIBED) and trust_decision (TRUST|DENY|NOT_APPLICABLE). Self-contained: node:crypto + RFC 8785 JCS + Ed25519 (RFC 8032), no network calls.

Input parameters:

- `atc` (object, required): The complete ATC JSON document to verify. Must include spec_version="ATC/1.0", card_id (pattern: ATC-YYYY-NNNNNNN), issuer, identity, attestation (with subject_public_key, signature, signed_payload_h…
- `ca_public_key` (string): TRUSTED CA public key (base64 SPKI) that YOU obtained out-of-band from the issuer's official channel (e.g. https://www.marketnow.site/api/atc?action=ca-key for MarketNow cards). REQUIRED for a trust…
- `fetch_revocation` (boolean): Deprecated/no-op: this verifier is self-contained (no network). Pass revocation_status instead.
- `mode` (string): trust (DEFAULT): fail-closed verification — ca_public_key required, revocation evidence required when the card demands it, never falls back to the card-embedded key. self_described: debugging/interop…
- `revocation_status` (object): Revocation evidence, required in TRUST mode when atc.revocation.revocation_check_required=true. Accepts: (a) a pre-fetched revocation list — MarketNow live CRL/ledger {cards:[{card_id,status,reason?,…

### `marketnow_check_revocation` (~233 tokens)

Check the revocation status of an Agent Trust Card (card_id) or CA key (kid) against the signed MarketNow Revocation Registry (MNR-CRL-1.0) + live ledger. Use this BEFORE trusting or caching any ATC — a card that verified cryptographically yesterday may be REVOKED today (e.g. mn-ca-002 was revoked for key compromise on 2026-09-08). Returns status (VALID/EXPIRED/REVOKED/SUPERSEDED/UNKNOWN) + recommendation (PERMIT/DENY), fail-closed on unknown subjects, with the CRL signature embedded so you can verify the signed layer independently.

Input parameters:

- `card_id` (string): Agent Trust Card ID (e.g. ATC-2026-1509360). Exactly one of card_id / kid.
- `kid` (string): CA key ID (e.g. mn-ca-002, mn-ca-003). Exactly one of card_id / kid.
- `nonce` (string): Optional client nonce — echoed in the response for anti-replay assurance.

### `marketnow_fingerprint_tool` (~190 tokens)

Cryptographically fingerprint MCP tool definitions (TFP-1.0): SHA-256 over the RFC 8785 JCS canonical form of each tool plus a manifest fingerprint for the whole tools/list surface. Use this (1) on first contact with any MCP server to PIN its tool surface, and (2) on every subsequent tools/list with the pinned manifest to detect drift — the OWASP MCP Cheat Sheet control 'verify tool descriptions haven't changed' (tool poisoning / rug-pull redefinitions). Fully self-contained: no network calls.

Input parameters:

- `pinned` (object): Optional: the manifest from a previous marketnow_fingerprint_tool call ({ tools: [{name, fingerprint_sha256}], manifest_fingerprint_sha256 }) — enables the drift report (added/removed/changed).
- `tools` (array, required): Tool definitions exactly as returned by tools/list: [{ name, description, inputSchema }].

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/alicelabs-llc-marketnow/marketnow-mcp#diagnostics

## Score history

- 2026-10-18: 69
- 2026-10-17: 69
- 2026-10-16: 69
- 2026-10-15: 68
- 2026-10-14: 68
- 2026-10-13: 67
- 2026-10-12: 67
- 2026-10-11: 66
- 2026-10-05: 61
- 2026-10-04: 61
- 2026-10-03: 61
- 2026-10-02: 61
- 2026-10-01: 61
- 2026-09-30: 61
- 2026-09-29: 46

## Common questions

### What is the MarketNow MCP server?

MarketNow is an MCP server listed in the public MCP registry as io.github.alicelabs-llc/marketnow. Verify agent credentials, 9 formats, scam domains; search 70k+ MCP servers with auth-gate state. This page covers its npm package (marketnow-mcp).

### Is the MarketNow MCP server safe to use?

MarketNow scores 69 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 18 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the MarketNow MCP server expose?

MarketNow exposes 15 tools: marketnow_search_skills, marketnow_get_skill, marketnow_list_categories, marketnow_get_manifest, marketnow_get_install_command, and 10 more. Their descriptions and schemas cost roughly 2,794 tokens of context every time the server is loaded.

### Is the MarketNow MCP server still maintained?

MarketNow is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the MarketNow MCP server under?

MarketNow declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/marketnow-mcp
- Socket report: https://socket.dev/npm/package/marketnow-mcp
- Repository: https://github.com/alicelabs-llc/MARKETNOW
- Website: https://marketnow.site/
- Changelog RSS feed: https://verifymcp.io/servers/alicelabs-llc-marketnow/marketnow-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/alicelabs-llc-marketnow/marketnow-mcp.json
- HTML version of this page: https://verifymcp.io/servers/alicelabs-llc-marketnow/marketnow-mcp