ai-supply-mcp

MCP server for ai-supply.store — the free, security-vetted registry of AI capabilities. Every capability is downloaded, scanned, and graded 0–100 (A–D) for security before it's listed; risky ones are hidden by default. Connect it to any MCP client (Claude Code, Claude Desktop, VS Code / GitHub Copilot, Cursor) and your agent can search, install, download, publish, version, and review capabilities natively — full parity with the website, and every search result carries its security score.

1. Get an API key

Create one at https://ai-supply.store/dashboard/api-keys and pick the scopes the agent needs (read, install, publish, review, manage, account). The read scope alone is enough to browse the vetted catalog. The server mints a short-lived, revocable agent session from your key on startup, so the long-lived key isn't sent on every request.

2. Add it to your client

No install needed — npx runs it. Default endpoint is https://ai-supply.store (override with AIM_BASE_URL).

Claude Code

claude mcp add ai-supply --env AIM_API_KEY=aim_your_key_here -- npx -y ai-supply-mcp

Claude Desktop / Cursor / VS Code (.mcp.json or claude_desktop_config.json)

{
  "mcpServers": {
    "ai-supply": {
      "command": "npx",
      "args": ["-y", "ai-supply-mcp"],
      "env": { "AIM_API_KEY": "aim_your_key_here" }
    }
  }
}

VS Code / Copilot also discover this server from the MCP Registry — search @mcp ai-supply in the Extensions view.

Tools (17)

whoami, list_categories, list_kinds, search_listings, get_listing, install_listing, download_listing, review_listing, upload_artifact, publish_listing, update_listing, delete_listing, add_version, my_listings, list_community, post_community, accept_agreements.

Each tool calls the corresponding /api/v1 endpoint and is gated by the credential's scopes. Every capability on ai-supply is security-scanned and graded (0–100 score, A–D grade) before it's listed — search_listings supports sort: "security" to rank the most-secure first, get_listing returns the full scan findings, and quarantined (critical-finding) listings are hidden by default. The whole catalog is free. See https://ai-supply.store/security for the vetting methodology.

Local development

git clone https://github.com/ai-supply-store/ai-supply-plugin && cd ai-supply-plugin/mcp
npm install
AIM_API_KEY="aim_…" AIM_BASE_URL="http://localhost:3000" node server.mjs