Docs & FAQ

Can an agent sign up and get a gateway key?

Yes. Connect /api/for-agents/mcp. search and view need no account. register emails the owner a confirmation link and does not take a password. Open that link to choose a private website password; use it to sign in and manage subscriptions and keys, never send it to the agent. subscribe turns a free listing on, or returns a Stripe Checkout link for a paid one. setup, after the email is confirmed and a subscription is active, returns the gateway config. That key calls every server the account is subscribed to. Card numbers stay on Stripe. These tools do not call those servers themselves.

Does the agent create or know my password?

No. register accepts your email only. The backend creates an initial random password internally but never returns it. You open the emailed confirmation link and choose your own private website password. Successful confirmation does not automatically sign you in; use /login when you want to manage or cancel subscriptions or revoke keys. The agent continues using its enrollment token, not your password.

What is the difference between my password, enrollment token, and gateway key?

Your password is your private website login. The enrollment token is the agent's temporary credential for subscribe and setup, expires 7 days after registration, and is returned only on the first new-account registration. After confirmation, its holder can obtain gateway access, so keep it secret. The gateway key returned inside the setup config calls all servers the account subscribes to; store it in your authorized MCP client and manage it under Dashboard → API Keys. Enrollment expiry does not expire the gateway key.

What does the owner need to do for a paid subscription?

First open the confirmation email and set your private website password. Then let the agent call subscribe. For a paid listing, open the returned Stripe Checkout link and pay on Stripe; never send card details to a tool. Tell the agent to call setup afterwards so it can verify payment and obtain the gateway config. A checkout link alone does not grant access, and the checkout return page needs a signed-in browser session to fulfill the purchase itself.

What happens if a link expires, I lose the token, or I already have an account?

Confirmation links last 24 hours and are single-use. Repeating register for an unconfirmed account resends the email but does not issue a new enrollment token. Verified accounts do not receive a token from register. If the enrollment token is lost or expires after 7 days, sign in on the website instead; password recovery does not renew it. For an account created by an agent with no usable password, choose Forgot password on /login. Recovery links last one hour and are single-use.

Does changing my password or deleting a gateway key cancel everything?

No. Cancel subscriptions on the website to stop their billing; revoking a gateway key is a separate action. Do not assume a password change or gateway-key revocation invalidates an unexpired enrollment token. If that token is exposed, contact support for account-specific remediation. Keep emailed confirmation and recovery links private too, and never share them with an agent.

How is this different from Community MCP?

Community MCP explains Builder, skills, documents, and REST setup. Those tools cannot issue a key or start checkout. For agents is how an agent becomes a customer. Details are on /for-agents.

What is free, and where are the examples?

Builder Community offers bounded read-only API inspection, skill-link checks and setup guidance. Skills over MCP offers selected public/free content; Documents has a free allowance; REST supports free listings; Dev Studio has a free development tier. These are separate offerings, not an unlimited bundle. Visit Community MCP for current policy descriptions, public tool examples, limits and setup links; check availability in the dashboard.

Can MCP tools create my platform key or enable access?

Community MCP tools cannot. Register, enable offerings, and manage keys for those tools on the website, and never put a key in chat or tool arguments. For agents can register an email, subscribe, and return a gateway key after confirmation. See /for-agents.

I found an MCP I want. What now?

What do I put in my client config?

One gateway entry, whatever you subscribe to. The Connect tab on each listing generates this for Cursor, Claude Desktop, Windsurf and Continue with your platform and paths filled in — copy it from there rather than hand-editing.

{
  "mcpServers": {
    "mcp-market": {
      "url": "https://www.mcpchannel.ai/api/mcp",
      "headers": { "X-MCP-Market-Key": "mcp_YOUR_KEY_HERE" }
    }
  }
}

Replace mcp_YOUR_KEY_HERE with the key from Dashboard → API Keys, where you can also reveal an existing key rather than issuing a new one.

Why one URL for everything?

You configure the gateway once and subscribe as often as you like. A new subscription shows up as new tools in the same client without touching a config file, and unsubscribing removes them the same way. It also means one key to rotate instead of one per provider, and the provider never sees your key — the gateway authenticates you, then calls them.

The listing asked me for an API key or a hostname. Why?

Some MCPs act on an account you already have — your own server, your own upstream key — so they cannot work until you supply it. Those listings show a setup form on your dashboard after you subscribe. Values are encrypted, sent only to that provider, and secrets are masked once saved. Tools return a setup-required message until the form is complete.

My tools are not showing up.

How am I billed, and what happens if I cancel?

Flat-rate listings bill monthly through Stripe. Metered listings bill for what you call, invoiced as usage accrues rather than in one lump at period end. Every call is recorded and shown on Dashboard → Billing, broken down per listing, so a surprise is traceable to the tool that caused it. Cancelling stops future billing and removes that listing's tools from your gateway at the end of the period — your API key and any other subscriptions are unaffected.

What is Dev Studio?

A browser-based IDE where you write MCP servers in TypeScript or Python, test tools in an isolated sandbox, and deploy with one click. No local setup needed — everything runs in the cloud.

How do I create a project?

What languages and libraries are supported?

TypeScript and Python. ~330 pre-approved npm/PyPI packages are available including @modelcontextprotocol/sdk, openai, anthropic, supabase, stripe, axios, pandas, and more. Request new packages via the in-editor form.

How does AI assist work?

Press ⌘I to open AI Chat. Choose Add (generate new code), Edit (modify existing), or Fix (debug errors). Supports OpenAI, Gemini, and Claude — use the platform's tokens (free tier: 10K/day) or bring your own API key for unlimited usage.

What are the plans?

How do I deploy to production?

On the Pro plan, click Deploy. MCP Channel hosts the server. People use it by subscribing to the listing and calling it through the same gateway as every other MCP. Publishing the listing is a separate step, and there is no address to paste into a client. Test Deploy stays in the editor for the signed-in owner: about an hour, and a limited number of calls.

Can I deploy elsewhere?

Yes. Click Export to download a ZIP with all source files, package.json/requirements.txt, tsconfig, .env.example, and a README with setup instructions. Deploy to Vercel, Railway, Cloud Run, or any platform. You can also push directly to GitHub.

Where do I see how my server actually ran?

Sign in and open your listing. The report is included. It is built from calls that passed through MCP Channel. Choose the last 24 hours, 7 days, 30 days, or 90 days. Each window is compared with the one before it.

What is included?

Is this a paid add-on?

Basic recording, charts, rule-based doctor and Ask answers, Explain, comparisons, and Call statistics are free after sign-in. Consumers can open Dashboard > Observability. AI assistance and active evaluations use the analytics trial or the allowance included in MCP Channel Pro ($25/month, including Dev Studio). Marketplace listing subscriptions remain separate.

Can I evaluate a server without publishing it, and what does AI cost?

Yes. Sign in and open Observe & Evaluate to connect a private public-HTTPS Streamable HTTP MCP endpoint. No marketplace listing or editor project is required. Basic definition checks are free. The one-time 7-day analytics trial includes 10,000 evaluation calls. MCP Channel Pro is $25/month and includes Dev Studio plus 50,000 evaluation calls per billing month. Analytics AI shares Dev Studio's daily token pool: 10,000 on Free or 200,000 on Pro, resetting at midnight UTC. There is no extra analytics AI allowance. Existing Pro subscribers are included. Evaluation-call and AI limits are hard caps; Dev Studio hosting overages remain unchanged. Test calls require approval and may incur provider charges. Registration does not monitor existing traffic.

How many AI answers are included?

One subscription, one shared AI pool. Dev Studio Grade and AI Assist, analytics Ask rewrites, description proposals, and private AI grading all use the same daily allowance: 10,000 tokens on Free or 200,000 on Pro, resetting at midnight UTC without rollover. Usage in either product reduces the same balance. Analytics access still requires an active trial or Pro subscription. Basic charts, rule-based answers, and tests without AI grading spend no platform AI tokens; approved tests still count toward the separate evaluation-call allowance.

What is kept from a call?

The report keeps the tool name, whether the call succeeded, how long it took, when it happened, and the client name when one was sent. It does not keep the full contents of a call. A failed call can keep a short redacted note so Explain can compare that row with the tool. That note is not on the call list, the download, or a report you share.

Can someone else view the report?

You can invite them by email. They can view that server only after they confirm. You can also mark a release, save a filter, and ask for an email when failures or slow calls jump.

Can I try a change without using a real call?

Yes. Save a practice case you type yourself and run it against a development server. MCP Channel does not replay a production call, and that practice run is not added to the report.

How do I convert my REST API to MCP?

Paste your OpenAPI spec (JSON or YAML) when creating a listing. We auto-generate MCP tools from every endpoint — one operation becomes one tool. Schemas, auth, and request bodies are resolved automatically.

What gets converted?

Do I need to change my backend?

No. The gateway proxies requests to your existing REST API. Your API doesn't know it's being called via MCP — it receives normal HTTP requests with the same auth headers.

I have docs, not an API. Can I still list an MCP?

Yes. Dashboard → Documents: name the listing, upload text files. We publish it on Browse with two tools — ask and list_documents. You do not host a server.

How do other people call it?

The same way they call every listing here. They subscribe, create one marketplace key, and point Cursor at the gateway. They never receive a second URL.

{
  "mcpServers": {
    "mcp-server": {
      "url": "https://www.mcpchannel.ai/api/mcp",
      "headers": { "X-MCP-Market-Key": "mcp_YOUR_KEY_HERE" }
    }
  }
}

The Connect tab on the listing generates this for Cursor, Claude, Windsurf, Continue and Zed. The full walkthrough is on /docs-to-mcp.

Is it free?

Yes to start. Extra usage is on Dashboard → Documents after you sign in.

What is mcpchannel.ai?

A marketplace and proxy gateway for MCP servers and agents. As a provider you publish your MCP listing once. Consumers subscribe and the platform gateway routes all their tool calls to your server — handling auth, metering, and billing.

What is the gateway?

Every consumer tool call goes through the mcpchannel.ai gateway before reaching your server. The gateway authenticates the consumer, injects any OAuth token or provider headers, enforces usage caps, and records metered usage. Your server only has to handle the tool call itself.

What does a request to my MCP server look like?

POST https://your-mcp-server.com/mcp
Authorization: Bearer <consumer-oauth-token>   ← injected by gateway (if OAuth enabled)
X-MCP-Market-Verification: mkt_v1_abc9f3...    ← platform-generated, always sent
X-Provider-Key: your-static-secret              ← from your Provider auth headers (if set)
Content-Type: application/json

{"jsonrpc":"2.0","method":"tools/call","params":{"name":"your_tool","arguments":{}}}

What are Provider auth headers?

Static key-value headers you configure once on your listing. The gateway sends them on every request to your MCP server — introspection, tool calls, everything. Use them so your server can verify that requests are coming from the gateway.

When should I add Provider auth headers?

Any time your MCP server requires authentication before accepting requests. If your server is open to the internet with no auth, you don't need them — but it's strongly recommended to add at least one so random internet traffic can't call your tools.

What header name should I use?

If OAuth is enabled, avoid Authorization — the gateway overwrites it with the consumer's live Bearer token. Use X-Provider-Key instead.

How do I verify Provider auth headers on my server?

// Express / Node.js
const key = req.headers["x-provider-key"];
if (key !== process.env.PROVIDER_SECRET) {
  return res.status(401).json({ error: "Unauthorized" });
}

# Flask / FastAPI
key = request.headers.get("X-Provider-Key")
if key != os.environ.get("PROVIDER_SECRET"):
    return jsonify({"error": "Unauthorized"}), 401

// net/http
key := r.Header.Get("X-Provider-Key")
if key != os.Getenv("PROVIDER_SECRET") {
    http.Error(w, "Unauthorized", http.StatusUnauthorized)
    return
}

What is X-MCP-Market-Verification?

A platform-generated secret unique to your listing. The gateway always injects it. Your server can check it to confirm that requests came through the marketplace gateway — not from someone calling your MCP directly.

How is it different from Provider auth headers?

How do I check X-MCP-Market-Verification on my server?

const verify = req.headers["x-mcp-market-verification"];
if (verify !== process.env.MCP_MARKET_VERIFICATION_TOKEN) {
  return res.status(401).json({ error: "Not from marketplace" });
}

import os
verify = request.headers.get("X-MCP-Market-Verification")
if verify != os.environ.get("MCP_MARKET_VERIFICATION_TOKEN"):
    return jsonify({"error": "Not from marketplace"}), 401

import "os"
verify := r.Header.Get("X-MCP-Market-Verification")
if verify != os.Getenv("MCP_MARKET_VERIFICATION_TOKEN") {
    http.Error(w, "Not from marketplace", http.StatusUnauthorized)
    return
}

Copy the verification secret from the Market verification section on your listing's edit page after saving.

What is Consumer OAuth?

An optional flow where each consumer authenticates with their own identity before calling tools. The gateway fetches a fresh Bearer token per consumer and injects it as Authorization: Bearer <token> on every request to your server. Your server validates the token to know which user is calling.

When should I enable Consumer OAuth?

What is the difference between client_credentials and authorization_code?

How does authorization_code work with GitHub? (provider sets up once)

Provider OAuth credentials storage is coming soon. Currently the platform uses client_credentials flow where each consumer provides their own credentials.

How does client_credentials work? (consumer brings their own credentials)

What is the platform's OAuth callback URL?

https://mcpchannel.ai/oauth/callback

// This is the redirect_uri the platform uses during authorization_code flows.
// Register this exact URL in your OAuth provider's app settings
// (GitHub, Google, Slack, etc.) as the allowed redirect URI.

How does the gateway inject the OAuth token?

The gateway calls your Token URL server-to-server, gets a fresh access_token, and injects it as Authorization: Bearer <token> on the request to your MCP. Your server then validates the token against your OAuth provider's /userinfo or introspection endpoint to identify the consumer.

Why can't I use Authorization in Provider auth headers when OAuth is on?

The gateway sets Authorization: Bearer <consumer-token> on every request. If you also put Authorization in your Provider auth headers, the gateway overwrites it — your static key is lost. Use X-Provider-Key instead so both values reach your server without conflict.

How do I validate the OAuth token on my server?

// Call your OAuth provider's userinfo endpoint
const res = await fetch("https://api.github.com/user", {
  headers: { Authorization: req.headers["authorization"] },
});
if (!res.ok) return reply.status(401).send({ error: "Invalid token" });
const user = await res.json();
// user.login = GitHub username, user.id = GitHub user ID

import httpx
token = request.headers.get("Authorization")
r = httpx.get("https://api.github.com/user",
               headers={"Authorization": token})
if r.status_code != 200:
    return jsonify({"error": "Invalid token"}), 401
user = r.json()  # user["login"] = GitHub username

token := r.Header.Get("Authorization")
req, _ := http.NewRequest("GET", "https://api.github.com/user", nil)
req.Header.Set("Authorization", token)
resp, err := http.DefaultClient.Do(req)
if err != nil || resp.StatusCode != 200 {
    http.Error(w, "Invalid token", http.StatusUnauthorized)
    return
}

What does the Validate button do?

It calls your MCP's introspection endpoint (tools/list, prompts/list, resources/list) using the URL and headers you've configured, and reports back how many tools, prompts, and resources were found. This confirms the gateway can reach your server before you publish.

My MCP requires OAuth — how do I validate it?

Expand the Consumer OAuth section, enter your Token URL, Client ID, and Client Secret, then click Fetch token. The token fills in automatically. Then click Validate — the gateway calls your server with that token in the Authorization header.

Validation fails with 'Could not reach Token URL'

The token fetch goes server-to-server (Next.js → your OAuth server), so CORS is not an issue. Check that: (1) your OAuth server is running, (2) the Token URL is correct and publicly reachable, (3) your Client ID and Secret are valid.

Validation fails with 401 Unauthorized

Your MCP server rejected the request. Check that the Provider auth headers match what your server expects, and if OAuth is on, that the fetched token is valid and your server's token validation logic is correct.

Static API key only (no OAuth)

Per-user OAuth with GitHub

System-to-system with client_credentials (no user login)

Maximum security — both Provider key and Market verification