
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
Check a remote MCP server against the Claude directory rules and publish it: npm, MCP Registry, Claude Code plugin, Claude connector directory.
Check a remote MCP server against the Claude connector directory rules, then publish it: npm, the official MCP Registry, a Claude Code plugin repo and the Claude connector directory. One step at a time, for people and for agents.
npx mcpship init https://example.com/mcp # writes publish.json; fill in the fields
MCPSHIP_TOKEN=<access token or API key> npx mcpship check
npx mcpship next # the next step, with the exact command
| Command | What it does |
|---|---|
init <url> | Writes a publish.json template in the current folder |
check [url] | Tests sign-in discovery, tools and listing; exit code 1 if a rule fails |
packet | Writes docs/directory/submission.md: the text for each directory form step |
next | The first unfinished step, with the command or click |
status | Live state of npm, the MCP Registry, the plugin repo and the directory |
done directory | Records that you submitted the directory form |
mcp | Runs as a local MCP server over stdio |
Add --json for machine-readable output and --dir <path> to point at another folder.
npm counts as published only when you are a maintainer of the package. mcpship asks npm whoami; if you publish with a token instead of npm login, set channels.npm.maintainer to your npm user name in publish.json.
| Rule | Fails when |
|---|---|
| auth.https | the server URL is not https |
| auth.www-authenticate | an unauthenticated call does not return 401 with resource_metadata |
| auth.resource-metadata | protected resource metadata is missing or has no authorization server |
| auth.as-metadata | authorization server metadata is missing |
| auth.pkce | S256 is not supported |
| auth.client-registration | neither Dynamic Client Registration nor Client ID Metadata Documents |
| tools.reachable | tools/list fails with the given token (skipped without one) |
| tools.title | a tool has no title |
| tools.annotations | a tool has neither readOnlyHint nor destructiveHint |
| tools.instructions | a description tells the model what to do ("use it first", "you must", "call X") |
| tools.hidden-text | a description holds invisible characters or encoded text |
| listing.icon-url | the icon URL is not a public https PNG |
| listing.pages | docs, privacy or terms page does not load |
| listing.lengths | name, one-liner or description is over the form limit, or a field is empty |
| listing.unpublished-mention | a page tells users to run npx <package> before it is on npm |
Warnings: tools.mentions (a description names another tool) and listing.em-dash.
/plugin marketplace add emanueltns/mcpship
/plugin install mcpship@mcpship
Then ask Claude to publish your MCP server. The plugin adds the mcpship tools and a skill that walks through each step.
mcpship runs on your machine. It calls your server, the URLs in your publish.json, the MCP Registry API, and whatever npm and gh call. It sends no telemetry. MCPSHIP_TOKEN is read from the environment and never printed.
MIT
FAQs
Check a remote MCP server against the Claude directory rules and publish it: npm, MCP Registry, Claude Code plugin, Claude connector directory.
The npm package mcpship receives a total of 23 weekly downloads. As such, mcpship popularity was classified as not popular.
We found that mcpship demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.