MarketNow — Trust Layer for Agent Commerce

⭐ If MarketNow is useful to you, please star the repo. It helps other developers discover it.

8,764 MCP servers. Each Sentinel-audited with 6 layers (L1.5 → L2.5 gVisor sandbox). Signed SHA-256 certificates. Public verification at marketnow.site/verify.

Sentinel Certified

🤖 What is MarketNow?

MarketNow is the open marketplace for MCP-compatible agent skills. It allows any agent (Claude Desktop, Cursor, Cline, VS Code) to search, discover, and install Sentinel-certified skills via the Model Context Protocol.

The code is open source. What you pay for is trust, certification, and integration.

🛡️ Sentinel Certification

Every skill in MarketNow is audited by Sentinel, a 6-layer security pipeline:

L1.5 — Metadata Checks (real-time, ~200ms on Vercel)

• AUTH (does the server require authentication?)
• Tool description injection (prompt injection patterns)
• Input validation (fs/db/http access detection)
• CORS policy
• OAuth scopes
• Rate limiting + error leakage

L1.6 — Static Analysis (real-time + weekly batch)

• 18 Semgrep-equivalent rules (prompt injection, command injection, SSRF, path traversal, tool forgery)
• 18 secret patterns (Stripe, AWS, GitHub, JWT, private keys, wallet mnemonics)
• OSV API real-time dependency vulnerability check

L2 v2.0 — Active MCP Probe + Docker Sandbox (async via GitHub Actions)

L2.5 adds gVisor (runsc) userspace kernel isolation on top of Docker. The MCP server never touches the host kernel. Runs the actual MCP server in isolation:

docker run --rm \
  --network none \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 256m --cpus 0.5 \
  mcp-audit-target

Analyzes stdout for: network attempts, fs writes, process spawns, credential leakage, crashes, dynamic imports.

Results (live at marketnow.site/sentinel-transparency)

L2 coverage: 206 of 8,764 skills have L2.5 gVisor sandbox results. The remaining 8,558 are certified with L1.5+L1.6 (static analysis). L2 coverage grows weekly via automated GitHub Actions.

Each skill gets a signed SHA-256 certificate with:

• certificate_id (MN-SC-2026-XXXXXXX)
• overall_score (0-10)
• risk_level (low/medium/high/critical)
• 7-day validity (regenerated weekly by GitHub Actions cron)

Verify any certificate: https://marketnow.site/verify Transparency dashboard: https://marketnow.site/sentinel-transparency All certificates: _data/sentinel_certificates/

Markdown Badges

Skill authors can embed a certified badge in their READMEs:

[![Sentinel Certified](https://marketnow.site/badges/sentinel-certified-mn-gen-00003.svg)](https://marketnow.site/skill/mn-gen-00003)

📊 Stats

🚀 Quick Start

Install MCP Server (Claude Desktop, Cursor, Cline)

{
  "mcpServers": {
    "marketnow": {
      "command": "npx",
      "args": ["-y", "marketnow-mcp"]
    }
  }
}

Now your agent can:

• Search 8,764 certified skills by query, category, or language
• Get full skill details with system prompts and Sentinel security reports
• Verify any skill's signed certificate
• Get install commands for any skill

Verify a Certificate

# Check any skill's certificate via API
curl "https://marketnow.site/api/audit-skill?certificate=1&skillId=mn-gen-00003" | jq

# Or verify visually at:
# https://marketnow.site/verify?skillId=mn-gen-00003

Search Skills

# Search for web scrapers
curl "https://marketnow.site/api/search?q=scrape" | jq

# Search in Chinese
curl "https://marketnow.site/api/search?q=数据库&language=zh" | jq

💰 Pricing (B2B)

MarketNow uses B2B pricing — no per-skill purchases:

Commission: 20% MarketNow, 80% seller (for paid skills)

📡 Public API (no auth required)

🔧 MCP Server Tools

🔗 Links

• Website: https://marketnow.site
• Verify a certificate: https://marketnow.site/verify
• Transparency dashboard: https://marketnow.site/sentinel-transparency
• Security details: https://marketnow.site/security
• npm: https://www.npmjs.com/package/marketnow-mcp
• Smithery: https://smithery.ai/servers/eddyflores100/marketnow
• OpenAPI: https://marketnow.site/api/openapi.json
• Agent instructions: https://marketnow.site/api/agent.json

📜 License & IP Protection

ALL code in this repository is PROPRIETARY — property of AliceLabs LLC.

Anyone who wants to commercialize, redistribute, or build upon any part of this codebase MUST obtain written permission from AliceLabs LLC.

See:

• LICENSE — Full license terms (Proprietary)
• SENTINEL-LICENSE — Sentinel proprietary license terms
• TRADEMARK_NOTICE — Trademark usage guidelines
• CLA — Contributor License Agreement

Patent pending on the 6-layer audit pipeline design (L1.5 → L1.6 → L2 → L2.5 → L3 → L4 → L5).

For licensing inquiries: legal@alicelabs.site For support: support@alicelabs.site General inquiries: info@alicelabs.site

Report IP violations: legal@alicelabs.site

Built for autonomous agents. Every skill has a signed Sentinel certificate, a ready-to-use system prompt, and auto-configured install. ALL code is proprietary property of AliceLabs LLC. Commercial use requires written permission.