Security
Listed means audited. Here's what that guarantee covers.
The review
Every submitted version (hosted or link-out, free or paid) runs through the same pipeline: automated scanners (dependency audit, secret detection, static egress extraction, sandbox diffing) feed their findings plus the full source and tool manifest to an AI review agent. It emits a structured report, a pass / flag / fail verdict and the human-readable data-flow summary published on each listing. Passes publish automatically; flags and fails escalate to a human.
The badge
The AI-review badge on a listing carries the review model and badge version and links to the data-flow summary for that exact version. Versions are immutable and re-reviewed on every bump.
Runtime containment
Every hosted tool declares the hosts it sends data to. That declaration is checked against the source during review: a tool whose code calls a host it did not declare does not publish until a human looks at it.
How the declaration is applied at runtime depends on where the tool runs. First-party tools that run inside our gateway can only reach declared hosts, because every request they make goes through a guarded fetch that refuses the rest. Tools that run in a container are not network-confined today: the declaration is a reviewed statement of intent, not a boundary the network enforces. Read it as what the code was reviewed to do, not as a limit on what it can do.
Third-party API credentials are stored platform-encrypted per entitlement and injected at dispatch, so they never live in tool code. Our own infrastructure credentials are removed from the environment we hand a tool, and the process that supervises it refuses to serve any tool but its own. That supervisor shares a container with the tool, so treat it as hardening rather than as an isolation boundary. The credential it holds reads our bundle store and nothing else.
Disclosure
Found something? Email security@mcpcommons.com. We acknowledge reports within one business day, unroute affected slugs immediately as a kill switch when warranted and publish a postmortem after resolution.