How to Get on the Marketplace

Anyone can submit an MCP server to the FrootAI marketplace by opening a pull request. This walkthrough mirrors the maintainer process so your PR lands green the first time.

The marketplace data is open (CC0-1.0). A listing is an attach spec plus trust evidence — both reviewable in the PR.

Before you start

You’ll touch two directories in the frootai/ repo:

orchard/registry/mcp-specs/ — the attach spec (<slug>.json).
orchard/registry/mcp-trust-evidence/ — the per-publisher evidence file.

Pick a slug: lowercase kebab-case, and slug === filename === tool_prefix.

1. Establish trust for the publisher

The spec’s publisher must already be a knownPublishers key in trust.json. If your publisher isn’t there yet, add the trust evidence first:

Copy mcp-trust-evidence/_template.md to <publisher>.md.
Fill the frontmatter: publisher, tier, servers_covered, last_reviewed, reviewer, and the signals block.
Document at least one substantive positive signal for the verified-publisher tier (community servers attach behind a prompt and don’t require evidence).

Contact details never go in the committed file — they live in a gitignored *.contact.local.md overlay.

2. Author the attach spec


cp _template.json <slug>.json   # then fill every field

Required fields include transport (stdio command/args or an http-sse url), version_pin, env_vars, auth, sample_tools, destructive_tools, and at least one known_limitations entry. Keep slug === filename === tool_prefix.

Never put a literal secret in args or env_passthrough — pass variable names only.

3. Validate locally

From frootai-core/:


node tests/marketplace/specs-live.smoke.test.js
node tests/marketplace/spec-schema.smoke.test.js
node tests/marketplace/validate-spec.smoke.test.js

4. Seed the snapshot + docs


node scripts/marketplace/snapshot-tools.mjs <slug> --write
node scripts/marketplace/build-spec-docs.mjs --write

Run the snapshot with FAI_SNAPSHOT_LIVE=1 … --live --write to capture the real tools/list.

5. Add the attach E2E + run the full suite

Create tests/marketplace/specs/<slug>.test.mjs (a 2-line wrapper around runAttachE2E) and add <slug> to the matrix in .github/workflows/marketplace-attach-validate.yml, then:


node scripts/marketplace/run-marketplace-tests.js

CI invariants your PR must satisfy

slug === filename === tool_prefix.
publisher resolves to trust.json at the declared trust tier.
No literal secrets in args / env_passthrough.
version_pin is well-formed and tested_version is in range (or hosted).
At least one substantive limitation + its transport-derived gotcha.
Committed docs + snapshots stay byte-fresh.

After it merges

Your server appears in the marketplace with its trust badge, install count, and copy-ready mcp.json blocks.