What mpak does
Open-source registry for MCP server bundles with cryptographic ownership verification and security scanning.
Why teams reach for it: Unlike a metaregistry that only aggregates listings, mpak hosts the bundles themselves, runs 25 MCP-specific security controls across five domains on every publish and shows the resulting trust score and L1-L4 certification on each package; and because the whole stack is Apache 2.0, an organisation that will not point at mpak.dev can run its own instance with federation, policies and audit logging.
How mpak compares
Fields the vendor doesn't document are left blank here rather than guessed — a blank means nothing verified, not a "no."
- Public Api
- Yes
- Submission Model
- Verified ownership required
How will people and clients find it?
Registries & discovery tools are directories or catalogs that help people and AI clients find MCP servers that already exist.