Prove you control your server.

The fastest path: sign in, prove control of your server’s origin, attest your read-only tools, run the preview behavioral check, and consent to publish - all here, no curl. Prefer the command line? The manual steps are below.

• · A preview observation, not a guarantee. It states what a read-only probe observed (“no contract drift observed”). It is not a certification and never asserts your server is safe, secure, or verified-safe. No such claim is made or implied.
• · Owner-attested and consented. It is published at your request, on tools you attest as read-only, and human-confirmed by an mcpindex operator before it renders.
• · Subordinate to screening. It lives on its own axis, below and separate from mcpindex’s own screening verdict. It never overrides, upgrades, or substitutes for that verdict. See the methodology.
• · Re-checked, and revoked on drift. The observation is bound to the exact tool definitions you attested. If a contract drifts, the badge is re-checked and revoked - it is not a standing claim.
• · Preview, and evolving. This flow and the read-only probe are still being tuned. Treat the badge as a preview signal, not a finished product.

Only a server that is listed in the MCP registry and exposes an HTTP remote can be verified this way. Verification proves you control the origin of that remote URL, so a package-only or stdio-only server (no reachable HTTP origin) cannot be claimed through this flow. If your server page shows a remote endpoint, you can claim it.

The same flow the browser wizard above runs, step by step against the owner API - for popup-blocked browsers, scripted setups, or if you would rather drive it from a terminal.

Every request goes to https://owner.mcpindex.ai and carries your api_key as a bearer token. Replace io.github.you/your-serverwith your server’s registry name.

1. 01Get a free api_key

   Sign in with GitHub or Google via the self-serve login. It mints a free api_key and stores it at ~/.mcpindex/credentials.json. The login lives in the @mcp-index/sdk CLI.

   npx -p @mcp-index/sdk mcpindex login          # GitHub (default)
   npx -p @mcp-index/sdk mcpindex login --provider google
   
   # then export it for the calls below:
   export MCPINDEX_API_KEY="$(node -e "process.stdout.write(require(require('os').homedir()+'/.mcpindex/credentials.json').api_key)")"

2. 02Request a challenge

   Ask for a one-time token bound to your server. It is valid for 15 minutes.

   curl -sX POST https://owner.mcpindex.ai/owner/challenge \
     -H "Authorization: Bearer $MCPINDEX_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"server_id":"io.github.you/your-server"}'
   
   # -> {"token":"<token>",
   #     "well_known_path":"/.well-known/mcpindex-challenge",
   #     "expires_at":"<iso8601>"}   # 15-minute TTL

3. 03Prove control of the origin

   Serve the exact token as plain text at /.well-known/mcpindex-challengeon the origin of your server’s remote URL. If your remote is https://mcp.example.com/sse, the token must be readable at https://mcp.example.com/.well-known/mcpindex-challenge.

4. 04Verify ownership

   mcpindex fetches the well-known path and checks the token matches. This only records proof of control - it opens no public badge.

   curl -sX POST https://owner.mcpindex.ai/owner/verify-ownership \
     -H "Authorization: Bearer $MCPINDEX_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"server_id":"io.github.you/your-server"}'
   
   # -> {"authorized":true}

5. 05Get your tools' hashes

   With the ownership grant from the previous step, ask mcpindex for your server’s live tools and the exact definition_hash it computes for each. This is a GET, authorized with your api_key - it hands you the values you would otherwise have to compute.

   curl -s https://owner.mcpindex.ai/owner/tools/io.github.you/your-server \
     -H "Authorization: Bearer $MCPINDEX_API_KEY"
   
   # -> {"server_id":"io.github.you/your-server",
   #     "as_of":"<iso8601>",
   #     "tools":[
   #       {"name":"search",
   #        "definition_hash":"sha256:<64-hex>",
   #        "probe_safe":true},
   #       ...]}

   Each entry is a tool mcpindex currently observes live on your server, paired with the exact definition_hash it will match against - so you no longer compute the sha256 yourself. The probe_safe flag is a heuristic hint of whether the tool looks read-only, i.e. safe to send malformed test input to. Attest just the tools where probe_safe: true, copying their name and definition_hash verbatim into the next step. If your server is unobservable, the response returns an empty tools list with a note.

   Honest caveat: probe_safe is a heuristic hint, not a guarantee - you confirm read-only-ness yourself, and record that human judgment in the attestation tag in the next step.

6. 06Attest your read-only tools

   List just the read-only tools you selected above - the ones safe to probe with malformed input. mcpindex probes nothing you do not attest, and re-checks the read-only heuristic on its side: a write, payment, or destructive tool is refused regardless. Each tool carries four fields; the first two are copied straight from the /owner/tools response above.

   • name- the tool’s advertised name, copied from the /owner/tools response.
   • definition_hash - copied verbatim from that same /owner/toolsresponse. It is the sha256 of the tool’s definition as mcpindex sees it live; because it came from mcpindex, it matches mcpindex’s own computed hash, so the tool is not skipped from the behavioral check. You no longer compute it yourself.
   • attestation - a human attestation tag of the form probe-attest-<date>-<label>-human-<who>. It must contain -human-; machine or self tags are rejected. It records that a human confirmed these tools are read-only-safe to probe.
   • confirmed_by - who confirmed.

   curl -sX POST https://owner.mcpindex.ai/owner/attest \
     -H "Authorization: Bearer $MCPINDEX_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"server_id":"io.github.you/your-server",
          "probe_safe_tools":[{"name":"search",
            "definition_hash":"sha256:<64-hex-copied-from-/owner/tools>",
            "attestation":"probe-attest-2026-07-19-search-human-confirmed",
            "confirmed_by":"you@example.com"}]}'

7. 07Run the behavioral check

   mcpindex runs a read-only conformance probe against the tools you attested, checking whether observed behavior matches the definitions you pinned. This is a preview probe, still being tuned: its result feeds only the owner preview observation and never graduates the public screen verdict, which stays semantic-only until the D3 milestone.

   curl -sX POST https://owner.mcpindex.ai/owner/verify-behavior \
     -H "Authorization: Bearer $MCPINDEX_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"server_id":"io.github.you/your-server"}'

8. 08Request publish (consent)

   Explicitly consent to publish the preview observation. Nothing is published without consent_publish: true.

   curl -sX POST https://owner.mcpindex.ai/owner/publish \
     -H "Authorization: Bearer $MCPINDEX_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"server_id":"io.github.you/your-server","consent_publish":true}'

9. 09mcpindex reviews, then it may appear

   A human operator reviews the request. If it is published, an Owner preview panel appears on your server’s page, clearly marked as a preview observation and subordinate to the screening verdict. It is re-checked over time and revoked if the contract drifts.