Creating an MCP

This guide walks you through publishing an MCP server to the MCP Hub catalog using the web dashboard. Once published and certified, your server becomes available for anyone to discover and run with smcp run.

Prerequisites

Before you begin, make sure you have:

1. An account on mcp-hub.info – Sign up at mcp-hub.info if you have not already.
2. A Git repository containing your MCP server source code. Supported languages are Python, TypeScript, JavaScript, and Go.
3. The repository must be accessible from the internet (public, or hosted on a provider that supports token-based cloning such as GitHub, GitLab, or Bitbucket).

Step 1: Log In

Navigate to mcp-hub.info and click Sign In in the top-right corner. You can authenticate with:

• GitHub – Recommended. Links your GitHub identity for origin verification.
• Email and password – Standard account creation with email confirmation.

If you sign in with GitHub, your verified identity allows your published packages to display the Verified origin badge instead of Community.

Step 2: Navigate to Create MCP

Once logged in, go to your Dashboard. You will see a navigation sidebar on the left. Click My MCPs, then click the Create MCP button in the top-right corner of the page.

Step 3: Enter Your Repository URL

The first section of the creation form asks for the source of your MCP server.

Enter the full Git repository URL. Supported formats include:

The platform will clone the repository and automatically detect the language, entry point, and dependencies.

Step 4: Configure Metadata

After entering the repository URL, fill in the metadata fields:

Choose your name carefully. Package names are unique within your organization and cannot be changed after creation.

Step 5: Submit for Analysis

Click the Create button to submit your MCP server. The platform immediately begins the automated analysis pipeline.

What Happens During Analysis

After submission, the platform performs the following steps automatically:

1. Clone – The repository is cloned from the URL you provided.
2. Detection – The platform identifies the programming language, runtime requirements, entry point, and dependency manifest.
3. Security scan – The mcp-scan engine runs 46+ security detectors across 14 vulnerability classes, including:
   • Prompt injection vectors
   • Data exfiltration paths
   • Privilege escalation patterns
   • Supply chain attack indicators
   • Credential exposure
   • Unsafe deserialization
   • Resource abuse patterns
4. Scoring – A deterministic security score from 0 to 100 is computed based on the findings.
5. Certification – The score maps to a certification level:

6. Artifact creation – A certified bundle is built, signed with a content-addressed SHA-256 digest, and published to the registry.

Analysis typically takes 1 to 5 minutes depending on the size of the repository and the number of dependencies.

Step 6: View Results

Navigate to Dashboard > My MCPs to check the status of your submission.

Each MCP entry displays its current status:

If Your MCP is Certified

Your package is now listed in the public catalog at mcp-hub.info/catalog. Anyone can install and run it with:

smcp run your-org/your-name@latest

The catalog card will display your name, description, origin badge, score, and version.

If Your MCP Failed

Click on the failed entry to see the detailed analysis report. The report lists each finding with:

• Vulnerability class (e.g. A: Prompt Injection, F: Data Exfiltration).
• Severity (Critical, High, Medium, Low, Info).
• Location in your source code (file, line number).
• Description of the issue and why it was flagged.
• Remediation guidance on how to fix it.

Fix the reported issues in your repository, then return to the dashboard and click Re-analyze to trigger a new scan.

Tips for a High Score

Follow these practices to maximize your security score and certification level:

• Keep your repository clean. Remove unused files, build artifacts, and temporary data before submitting. Extraneous files can trigger false positives or increase analysis time.
• Use standard entry points. Follow the conventions for your language: main.py or server.py for Python, index.ts or index.js for TypeScript/JavaScript, main.go for Go. The platform auto-detects standard entry points more reliably.
• Declare dependencies properly. Use requirements.txt or pyproject.toml for Python, package.json for Node.js, and go.mod for Go. Undeclared dependencies are flagged as supply chain risks.
• Avoid hardcoded credentials. Never embed API keys, passwords, or tokens in your source code. Use environment variables instead. The scanner specifically detects credential patterns.
• Minimize permissions. Only request the permissions your server actually needs. Requesting broad filesystem or network access without justification lowers your score.
• Handle errors safely. Do not expose stack traces, internal paths, or sensitive configuration in error messages. The scanner checks for information disclosure patterns.
• Pin your dependencies. Use exact versions rather than ranges. Unpinned dependencies are flagged as potential supply chain vectors.

Updating Your MCP

To publish a new version:

1. Push your changes to the Git repository.
2. Go to Dashboard > My MCPs and click on your MCP.
3. Click New Version to trigger a fresh analysis of the current repository state.

Each version goes through the full analysis pipeline independently. Previous versions remain available in the registry; users who pin to a specific version will continue to receive that exact version.

Next Steps

• Browsing the Catalog – See how your published MCP appears to users.
• Running MCP Servers – Test your published MCP by running it from the registry.