MCP Marketplace: Where to Find and Install Servers

There is no single MCP marketplace. There is an official registry (metadata only, in preview), several large community directories, a container catalog from Docker, a registry inside GitHub, and the plugin directories of individual agents. They list different things for different people. Use a marketplace to find candidates, then check the server yourself. We looked at each on 31 October 2026.

Quick facts

The map

The official MCP Registry

The MCP project's registry describes itself as providing MCP clients with a list of MCP servers, like an app store for MCP servers. A few facts from its repo:

• It stores metadata, not code. Its publishing guide says the registry only hosts metadata, not artifacts. A package-based server is published to npm or another package host first, then registered.
• Remote servers are supported. You can publish metadata for a server available at a public URL with no package. The registry verifies that you control the namespace in the name, not that you control the remote URL.
• A `server.json` file describes the server: name (for example io.github.my-username/weather), title, description, repository, version, and either packages or remotes with a transport type such as streamable-http.
• A publisher CLI, mcp-publisher, handles the flow, with GitHub-based authentication in the tutorial.
• Status. The README marks it as preview, with an API freeze at v0.1 announced on 24 October 2025 and a note that breaking changes or data resets may occur before general availability.

Why it matters: the registry is the closest thing to a neutral source of truth, and clients can read it by API. It is also not a quality filter. Anyone can publish.

Reference servers from the MCP project, the other official source, are examples to learn from. The project's README says they are educational, not production-ready, and points people looking for a list to the registry.

Glama

Glama's server directory showed 113,036 servers, updated on 30 October 2026, with facets you can filter by: language (Python, TypeScript), remote or local or hybrid, official, claimed, and categories such as developer tools, databases, security, browser automation, web scraping and knowledge and memory. It sorts by relevance, recent usage, date added or updated, weekly npm or PyPI downloads and GitHub stars. The punkpeye/awesome-mcp-servers README says its web directory is synced with the repo and shows score badges on entries.

Good for: breadth, filtering by language and scope, and spotting what is actively used. Caution: scale means a long tail of tiny or abandoned projects, and scores are Glama's own.

mcp.so

A community directory whose navigation shows Servers, Remote Servers, Clients, CLI, Loops, Skills, Agents, Collections, Rankings and Feed, plus submit and advertise links. Its home page promotes top categories such as developer tools, AI and agents, cloud and infrastructure, memory and knowledge, and media and design, and a featured strip labelled hand-picked.

Good for: browsing by category and finding clients and skills alongside servers. Caution: it sells advertising and features, so featured does not mean best.

GitHub MCP Registry

At github.com/mcp, GitHub's registry presents "servers and tools from the community that connect models to files, APIs, databases, and more", with a search box and, on 31 October 2026, 740 servers. Entries have an Install button. It makes sense if you work inside GitHub and Copilot, and it is much smaller than Glama, which can be a feature.

Docker MCP Catalog

Docker's catalog at hub.docker.com/mcp calls itself the largest library of containerized MCP servers, built by the community and powered by Docker. It groups servers by publisher, including vendors such as AWS Labs and Brave, and shows pull counts. Containers give you isolation and pinned versions, and the docker/mcp-gateway project (MIT) provides a CLI plugin to run them. See our Docker MCP page.

Good for: running servers without installing Node or Python, and keeping them away from your host. Caution: a container is a boundary, not a safety guarantee. Mounted volumes and passed-in tokens still reach the server.

Smithery

Smithery positions itself as a place to connect agents to thousands of tools and services, with authentication, credentials and sessions handled for you. Its docs describe a REST API for connections, token scoping, a CLI, publishing hosted or external or stdio servers, and a skills section. Its auth layer is powered by the open source agent.pw.

Two notices matter. Its docs header says Smithery is now a part of Arcade.dev. And its site shows a banner that Smithery's MCP Proxy and managed identity shut down on October 31, linking to a page about what is changing. If you used Smithery as a proxy, read that notice and plan a replacement. We could not read the linked page, so we do not describe what changes.

Agent-level marketplaces

The agents you use have their own directories.

• Claude Code adds the official plugin marketplace automatically. Anthropic's docs say most of what it lists comes from partners and other authors, and that a community marketplace is separate and added by hand. A plugin there can bundle an MCP server. See our plugins guide.
• Cursor has a marketplace with one-click install and OAuth, and points to cursor.directory for community entries.
• VS Code has a gallery reached with MCP: Add Server, Browse MCP Servers, and notes that your organisation can restrict which servers are available.
• Codex uses plugin marketplaces and its own codex mcp add.

These are convenient, and they are also the places where a bundled plugin can run code on your machine. Treat them as install channels, not as endorsements.

How to choose

A five-step habit for any marketplace

1. Find the repo or vendor page. Do not install from the listing alone.
2. Check the maintainer. Is it the vendor, or someone using the vendor's name?
3. Check activity. Last commit, archived flag, open issues.
4. Read the tools and scopes. Match them to the job.
5. Install with your agent's own command and a narrow token. Our Claude Code MCP servers guide shows the commands.

For teams: pick a channel and allow only that

If more than one person on your team installs servers, the marketplace question becomes a policy question.

• Choose one or two sources you accept, such as the official registry, the vendor's docs and a private shortlist. Write them down.
• Commit the config, not the install. In Claude Code a project .mcp.json lets everyone share the same reviewed servers, with an approval prompt per person. Cursor and VS Code have project config files too.
• Use managed policy where it exists. Claude Code documents a managed MCP configuration with allow and deny lists, and VS Code notes that organisations can restrict which servers are available. Codex lets you set enabled_tools and disabled_tools per server.
• Pin versions in anything you commit. A directory example with @latest is fine for a first try and a poor default for a team.
• Review changes. Treat a change to the MCP config like a change to a dependency file, with a pull request and an owner.
• Keep a short list of banned patterns, such as servers that need a personal token with write access to production.

What a good listing tells you

When you open a server's page in any directory, look for the details that let you decide without guessing:

If a listing hides most of these, go to the repo. If the repo hides them too, move on.

Risks specific to marketplaces

• Typosquats and copycats. Similar names, different owners. Confirm the organisation on the repo.
• Promoted placement. Featured strips and ads are paid or curated. They are not rankings of quality.
• Install buttons skip your review. A one-click install writes a command into your config. Read it.
• Version drift. @latest in a listing's example runs whatever is newest.
• Platform changes. Directories merge, shut services and rename. Smithery's notice is a live example.
• Prompt injection through descriptions. Tool descriptions are text the model reads. A malicious server can write them.

A worked example: finding a server for one job

Take a concrete job: you want your agent to read and update tickets in a project tracker. Here is the path through the sources, with what you look at in each.

1. Vendor docs first. Search the tracker's own documentation for "MCP". If the vendor runs a hosted server, that is almost always the better choice than a community one, since the vendor controls the tool list and the auth.
2. Registry second. If the vendor docs name a server, look it up in the official registry and check that the publisher matches the vendor's domain or organization.
3. Directory third. If there is no vendor server, a community directory lists several candidates. Open three and compare their tool lists, last update and licence.
4. Repository last. For the best candidate, read the README for auth and scopes, then skim the source for what it sends where.
5. Install narrow. Create a token limited to one project, with read access first. Add the server with your agent's own command, then ask a read-only question and check the result against the tracker.
6. Add writes later. Once reads work for a week, add write access to a test project and require approval for each call.

The same path works for a database, a cloud account or a chat tool. What changes is how much damage a wrong token can do, so the more powerful the system, the later you give the agent write access.

Signals that a listing is not what it seems

Marketplaces are open to anyone who can publish. A few patterns should make you slow down.

• A new account with a famous name. A server called after a well-known product, published by an account created last week, with few commits.
• A tool list that does more than the name suggests. A "weather" server with a file-read tool is suspicious.
• An install command that downloads and runs a script, or pipes a download into a shell.
• Requests for broad tokens. A server that asks for full-account access when the task needs one project.
• Descriptions that sound like instructions to the model. Tool text that says "always call this first" or "ignore previous rules" is a red flag, since descriptions are read by the model.
• No source link, or a link to a repository that does not match the published package.

None of these proves bad intent, since many small projects are sloppy, not hostile. They are reasons to run the server only in a scratch project with a throwaway token before you trust it.

What changes when a marketplace shuts or merges

Directories come and go, and the Smithery notice above is a current example. Your setup should not depend on one. Keep the install command and the version in your own repository, as in .mcp.json, so a directory disappearing does not break a working project. Keep a note of each server's real home, the repository or vendor page, because a listing can vanish while the code lives on. If you used a hosted proxy or managed identity from a directory, write down what it did for you, such as holding tokens or refreshing logins, so you can replace that job when the service changes.

Publishing your own server

If you maintain a server, you can list it in several places. The official registry takes metadata through mcp-publisher and server.json. Smithery documents publishing for hosted, external and stdio servers. Glama and mcp.so accept submissions. Write a clear README, a licence and a tool list, and keep the repo active. Our submit page will take listings for this directory as well.

Our take

We visited each site and read its docs. We did not install from each, and we do not rank them.

The honest summary is that discovery is solved and trust is not. Anyone can find a server among 113,000. Nobody can tell you from a listing whether it is safe. That is why we send people to the vendor's own docs and keep our own lists short and dated.

If we had to pick one habit, it is to use marketplaces for names and the repo for decisions. The listing tells you a server exists. The repo, the licence, the last commit and the tool list tell you whether to install it.

Frequently asked questions

Is there an official MCP marketplace? The MCP Registry, which holds metadata only and is in preview.

Which has the most servers? Glama, with 113,036 on 30 October 2026.

Are marketplace servers reviewed? Policies differ and none replaces your own check.

Can I install straight from a marketplace? Some offer buttons. Read the command first.

What happened to Smithery? It is part of Arcade.dev and its proxy and managed identity were shut down on 31 October 2026.

*Product names are used descriptively. We are not affiliated with any marketplace named here.*