Explore the Docs
Get Started
Install the CLI, run your first MCP server, and learn the core concepts in under 5 minutes.
Start hereGuides
Step-by-step walkthroughs for publishing MCPs, reading security reports, and managing your catalog.
Browse guidesReference
Complete CLI command reference, package format specification, and security controls documentation.
View referenceWhat Can You Do?
MCP Hub gives you everything you need to find, run, and publish MCP servers with confidence.
Explore the catalog at mcp-hub.info to find MCP servers that have been analyzed and certified. Filter by category, security score, and certification level.
Use the smcp run command to execute MCP servers with automatic sandboxing, policy enforcement, and resource isolation. No manual configuration needed.
Submit your MCP server through the web dashboard. MCP Hub automatically analyzes it for vulnerabilities, assigns a security score, and publishes it to the catalog.
Every MCP server has a detailed security report showing vulnerability findings, security controls status, and a breakdown of the certification score.
How It Works
MCP Hub takes MCP servers from source code to certified, sandboxed execution in five stages.
Publish
A developer submits their MCP server through the web dashboard by providing a Git repository URL or uploading source code directly.
Analyze
MCP Hub automatically scans the source code for security vulnerabilities across 14 vulnerability classes, including prompt injection, data exfiltration, and privilege escalation.
Certify
A security score from 0 to 100 is computed from the analysis results. The score determines the certification level (0 through 3), creating an immutable security snapshot.
Distribute
The certified package is published to the catalog and becomes available for anyone to browse, inspect, and download.
Execute
Users run smcp run org/name@version to download and execute the package inside a sandboxed environment with policy enforcement and resource limits.
Certification Levels
Every MCP server in the catalog is assigned a certification level based on automated security analysis.
Digest validation and schema checks passed. The package is what the publisher claims it is.
Basic static analysis completed. No critical vulnerabilities found in initial security scan.
Full analysis with evidence artifacts. Security controls verified with attestation and SBOM.
Dynamic analysis verified at runtime. The highest level of trust for production environments.
Ready to Get Started?
Install the CLI and run your first MCP server in under two minutes.