Short version: the catalogue is free to read, paid plans add monitoring and reports, and if a paid plan is not what you expected we return the money. The long version is below.
mcpbeat monitors MCP servers and agent skills: whether they answer, how often they are actually installed, when their code last changed, and what their code does. Everything published here is public information plus our own measurements.
Reading the catalogue requires no account and costs nothing. Paid plans add continuous monitoring of servers you choose, alerts when something about them changes, machine-readable admission policies and exportable reports.
We are not a certification authority. A server without findings is a server where our checks found nothing — not a guarantee that it is safe. Static analysis sees code, not intent, and it cannot see what a remote server does on its own machine.
Findings are produced by automated rules and can be wrong in both directions. We publish the file and line behind every finding so that any of them can be checked in a minute, and every author may dispute a finding — we correct what turns out to be wrong.
Uptime and availability of the site itself are provided as-is. Data comes from third parties (the MCP registry, npm, PyPI, GitHub), and when they are down or wrong, our numbers inherit that.
Nothing here is legal or security advice. Decisions about what to run in your own infrastructure remain yours.
Use the site and its data for any lawful purpose, including in commercial work. Attribution is appreciated but not required.
Do not attempt to break the service, scrape it in a way that degrades it for others, or resell raw access to it as your own dataset. Reasonable automated access is fine — there is an export and a set of machine-readable files for exactly that.
Accounts are personal. A team plan covers the people you invite into your workspace, not an unlimited pool of colleagues sharing one login.
Paid plans are billed monthly, in advance. There is no annual plan today — writing one into the terms before it exists would be a promise we cannot keep. Prices are shown before payment and do not change during a period you have already paid for.
A subscription renews automatically until cancelled. Cancel any time from the account area; access continues to the end of the paid period and is not cut off mid-term.
Payments are handled by our payment provider, which acts as the merchant of record and issues receipts and any applicable tax documents. We never see or store card details.
Within 14 days of a first payment we refund in full, no questions asked. Write to us and say you want the money back — that is the whole procedure.
After that, if the service did not work as described — monitoring did not run, alerts did not arrive, reports were unavailable — we refund the affected period. Tell us what went wrong; we check our own logs and, if we are at fault, return the money.
We do not refund because a finding turned out to be inconvenient, or because a monitored server behaved badly. We charge for watching and reporting, not for the behaviour of other people's software.
Refunds go back to the original payment method. Processing takes a few business days on the provider's side.
Every finding names the file and the line it came from. If it is wrong, write to us with that line and we will look. Corrections are free and do not require a plan — this is not a paid removal service, and it never will be.
Advertising and paid placement never affect findings. A sponsor with a security problem gets the same page as anyone else; this rule was written down before the first sponsor existed, on purpose.
If these terms change, the date above changes with them, and anything affecting money applies only from the next billing period.
Questions, disputes and refund requests: the contact page has the address. A human reads it.