
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
Check a remote MCP server against the Claude directory rules and publish it: npm, MCP Registry, Claude Code plugin, Claude connector directory.
Check a remote MCP server against the Claude connector directory rules, then publish it: npm, the official MCP Registry, a Claude Code plugin repo and the Claude connector directory. One step at a time, for people and for agents.
npx mcpship init https://example.com/mcp # writes publish.json; fill in the fields
MCPSHIP_TOKEN=<access token or API key> npx mcpship check
npx mcpship next # the next step, with the exact command
| Command | What it does |
|---|---|
init <url> | Writes a publish.json template in the current folder |
check [url] | Tests sign-in discovery, tools and listing; exit code 1 if a rule fails |
packet | Writes docs/directory/submission.md: the text for each directory form step |
next | The first unfinished step, with the command or click |
status | Live state of npm, the MCP Registry, the plugin repo and the directory |
done directory | Records that you submitted the directory form |
mcp | Runs as a local MCP server over stdio |
Add --json for machine-readable output and --dir <path> to point at another folder.
npm counts as published only when you are a maintainer of the package. mcpship asks npm whoami; if you publish with a token instead of npm login, set channels.npm.maintainer to your npm user name in publish.json.
| Rule | Fails when |
|---|---|
| auth.https | the server URL is not https |
| auth.www-authenticate | an unauthenticated call does not return 401 with resource_metadata |
| auth.resource-metadata | protected resource metadata is missing or has no authorization server |
| auth.as-metadata | authorization server metadata is missing |
| auth.pkce | S256 is not supported |
| auth.client-registration | neither Dynamic Client Registration nor Client ID Metadata Documents |
| tools.reachable | tools/list fails with the given token (skipped without one) |
| tools.title | a tool has no title |
| tools.annotations | a tool has neither readOnlyHint nor destructiveHint |
| tools.instructions | a description tells the model what to do ("use it first", "you must", "call X") |
| tools.hidden-text | a description holds invisible characters or encoded text |
| listing.icon-url | the icon URL is not a public https PNG |
| listing.pages | docs, privacy or terms page does not load |
| listing.lengths | name, one-liner or description is over the form limit, or a field is empty |
| listing.unpublished-mention | a page tells users to run npx <package> before it is on npm |
Warnings: tools.mentions (a description names another tool) and listing.em-dash.
/plugin marketplace add emanueltns/mcpship
/plugin install mcpship@mcpship
Then ask Claude to publish your MCP server. The plugin adds the mcpship tools and a skill that walks through each step.
mcpship runs on your machine. It calls your server, the URLs in your publish.json, the MCP Registry API, and whatever npm and gh call. It sends no telemetry. MCPSHIP_TOKEN is read from the environment and never printed.
MIT
FAQs
Check a remote MCP server against the Claude directory rules and publish it: npm, MCP Registry, Claude Code plugin, Claude connector directory.
The npm package mcpship receives a total of 28 weekly downloads. As such, mcpship popularity was classified as not popular.
We found that mcpship demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.