MCP server marketplaces compared: Smithery vs Glama vs PulseMCP vs MarketNow

Short summary

A developer compares four MCP server marketplaces—Smithery, Glama, PulseMCP, and MarketNow—across catalog size, security auditing, and pricing. The author (who built MarketNow) argues that while server discovery is solved, trust is not: MCP servers get read access to SSH keys, AWS credentials, and environment variables with no sandboxing. Three of 8,764 audited servers leaked environment variables when sent credential-access prompts, a vulnerability no marketplace besides MarketNow currently catches.

• •Four MCP marketplaces compared on catalog size, security, and pricing
• •Core problem: MCP servers get filesystem, network, and env-var access with no sandboxing
• •No marketplace verifies GitHub repo matches published npm package or does SLSA attestation

Generated with AI, which can make mistakes.