Docs & FAQ

What is free, and where are the examples?

Builder Community offers bounded read-only API inspection, skill-link checks and setup guidance. Skills over MCP offers selected public/free content; Documents has a free allowance; REST supports free listings; Dev Studio has a free development tier. These are separate offerings, not an unlimited bundle. Visit Community MCP for current policy descriptions, public tool examples, limits and setup links; check availability in the dashboard.

Can MCP tools create my platform key or enable access?

No. Register/sign in, enable marketplace offerings and create/manage your platform API key on the MCP Channel website. Skills over MCP instead uses a selected eligible collection. Enter the key in your MCP client's configuration, never chat or tool arguments. The Community tools explain setup but cannot issue keys, activate subscriptions, publish or charge.

I found an MCP I want. What now?

What do I put in my client config?

One gateway entry, whatever you subscribe to. The Connect tab on each listing generates this for Cursor, Claude Desktop, Windsurf and Continue with your platform and paths filled in — copy it from there rather than hand-editing.

{
  "mcpServers": {
    "mcp-market": {
      "url": "https://www.mcpchannel.ai/api/mcp",
      "headers": { "X-MCP-Market-Key": "mcp_YOUR_KEY_HERE" }
    }
  }
}

Replace mcp_YOUR_KEY_HERE with the key from Dashboard → API Keys, where you can also reveal an existing key rather than issuing a new one.

Why one URL for everything?

You configure the gateway once and subscribe as often as you like. A new subscription shows up as new tools in the same client without touching a config file, and unsubscribing removes them the same way. It also means one key to rotate instead of one per provider, and the provider never sees your key — the gateway authenticates you, then calls them.

The listing asked me for an API key or a hostname. Why?

Some MCPs act on an account you already have — your own server, your own upstream key — so they cannot work until you supply it. Those listings show a setup form on your dashboard after you subscribe. Values are encrypted, sent only to that provider, and secrets are masked once saved. Tools return a setup-required message until the form is complete.

My tools are not showing up.

How am I billed, and what happens if I cancel?

Flat-rate listings bill monthly through Stripe. Metered listings bill for what you call, invoiced as usage accrues rather than in one lump at period end. Every call is recorded and shown on Dashboard → Billing, broken down per listing, so a surprise is traceable to the tool that caused it. Cancelling stops future billing and removes that listing's tools from your gateway at the end of the period — your API key and any other subscriptions are unaffected.

What is Dev Studio?

A browser-based IDE where you write MCP servers in TypeScript or Python, test tools in an isolated sandbox, and deploy with one click. No local setup needed — everything runs in the cloud.

How do I create a project?

What languages and libraries are supported?

TypeScript and Python. ~330 pre-approved npm/PyPI packages are available including @modelcontextprotocol/sdk, openai, anthropic, supabase, stripe, axios, pandas, and more. Request new packages via the in-editor form.

How does AI assist work?

Press ⌘I to open AI Chat. Choose Add (generate new code), Edit (modify existing), or Fix (debug errors). Supports OpenAI, Gemini, and Claude — use the platform's tokens (free tier: 10K/day) or bring your own API key for unlimited usage.

What are the plans?

How do I deploy to production?

Click Deploy → Production. Your MCP gets a persistent URL at mcpchannel.ai/api/dev/mcp/your-slug. It's automatically listed on the marketplace. Consumers can subscribe and call your tools through the gateway.

Can I deploy elsewhere?

Yes. Click Export to download a ZIP with all source files, package.json/requirements.txt, tsconfig, .env.example, and a README with setup instructions. Deploy to Vercel, Railway, Cloud Run, or any platform. You can also push directly to GitHub.

How do I convert my REST API to MCP?

Paste your OpenAPI spec (JSON or YAML) when creating a listing. We auto-generate MCP tools from every endpoint — one operation becomes one tool. Schemas, auth, and request bodies are resolved automatically.

What gets converted?

Do I need to change my backend?

No. The gateway proxies requests to your existing REST API. Your API doesn't know it's being called via MCP — it receives normal HTTP requests with the same auth headers.

I have docs, not an API. Can I still list an MCP?

Yes. Dashboard → Documents: name the listing, upload text files. We publish it on Browse with two tools — ask and list_documents. You do not host a server.

How do other people call it?

The same way they call every listing here. They subscribe, create one marketplace key, and point Cursor at the gateway. They never receive a second URL.

{
  "mcpServers": {
    "mcp-server": {
      "url": "https://www.mcpchannel.ai/api/mcp",
      "headers": { "X-MCP-Market-Key": "mcp_YOUR_KEY_HERE" }
    }
  }
}

The Connect tab on the listing generates this for Cursor, Claude, Windsurf, Continue and Zed. The full walkthrough is on /docs-to-mcp.

Is it free?

Yes to start. Extra usage is on Dashboard → Documents after you sign in.

What is mcpchannel.ai?

A marketplace and proxy gateway for MCP servers and agents. As a provider you publish your MCP listing once. Consumers subscribe and the platform gateway routes all their tool calls to your server — handling auth, metering, and billing.

What is the gateway?

Every consumer tool call goes through the mcpchannel.ai gateway before reaching your server. The gateway authenticates the consumer, injects any OAuth token or provider headers, enforces usage caps, and records metered usage. Your server only has to handle the tool call itself.

What does a request to my MCP server look like?

POST https://your-mcp-server.com/mcp
Authorization: Bearer <consumer-oauth-token>   ← injected by gateway (if OAuth enabled)
X-MCP-Market-Verification: mkt_v1_abc9f3...    ← platform-generated, always sent
X-Provider-Key: your-static-secret              ← from your Provider auth headers (if set)
Content-Type: application/json

{"jsonrpc":"2.0","method":"tools/call","params":{"name":"your_tool","arguments":{}}}

What are Provider auth headers?

Static key-value headers you configure once on your listing. The gateway sends them on every request to your MCP server — introspection, tool calls, everything. Use them so your server can verify that requests are coming from the gateway.

When should I add Provider auth headers?

Any time your MCP server requires authentication before accepting requests. If your server is open to the internet with no auth, you don't need them — but it's strongly recommended to add at least one so random internet traffic can't call your tools.

What header name should I use?

If OAuth is enabled, avoid Authorization — the gateway overwrites it with the consumer's live Bearer token. Use X-Provider-Key instead.

How do I verify Provider auth headers on my server?

// Express / Node.js
const key = req.headers["x-provider-key"];
if (key !== process.env.PROVIDER_SECRET) {
  return res.status(401).json({ error: "Unauthorized" });
}

# Flask / FastAPI
key = request.headers.get("X-Provider-Key")
if key != os.environ.get("PROVIDER_SECRET"):
    return jsonify({"error": "Unauthorized"}), 401

// net/http
key := r.Header.Get("X-Provider-Key")
if key != os.Getenv("PROVIDER_SECRET") {
    http.Error(w, "Unauthorized", http.StatusUnauthorized)
    return
}

What is X-MCP-Market-Verification?

A platform-generated secret unique to your listing. The gateway always injects it. Your server can check it to confirm that requests came through the marketplace gateway — not from someone calling your MCP directly.

How is it different from Provider auth headers?

How do I check X-MCP-Market-Verification on my server?

const verify = req.headers["x-mcp-market-verification"];
if (verify !== process.env.MCP_MARKET_VERIFICATION_TOKEN) {
  return res.status(401).json({ error: "Not from marketplace" });
}

import os
verify = request.headers.get("X-MCP-Market-Verification")
if verify != os.environ.get("MCP_MARKET_VERIFICATION_TOKEN"):
    return jsonify({"error": "Not from marketplace"}), 401

import "os"
verify := r.Header.Get("X-MCP-Market-Verification")
if verify != os.Getenv("MCP_MARKET_VERIFICATION_TOKEN") {
    http.Error(w, "Not from marketplace", http.StatusUnauthorized)
    return
}

Copy the verification secret from the Market verification section on your listing's edit page after saving.

What is Consumer OAuth?

An optional flow where each consumer authenticates with their own identity before calling tools. The gateway fetches a fresh Bearer token per consumer and injects it as Authorization: Bearer <token> on every request to your server. Your server validates the token to know which user is calling.

When should I enable Consumer OAuth?

What is the difference between client_credentials and authorization_code?

How does authorization_code work with GitHub? (provider sets up once)

Provider OAuth credentials storage is coming soon. Currently the platform uses client_credentials flow where each consumer provides their own credentials.

How does client_credentials work? (consumer brings their own credentials)

What is the platform's OAuth callback URL?

https://mcpchannel.ai/oauth/callback

// This is the redirect_uri the platform uses during authorization_code flows.
// Register this exact URL in your OAuth provider's app settings
// (GitHub, Google, Slack, etc.) as the allowed redirect URI.

How does the gateway inject the OAuth token?

The gateway calls your Token URL server-to-server, gets a fresh access_token, and injects it as Authorization: Bearer <token> on the request to your MCP. Your server then validates the token against your OAuth provider's /userinfo or introspection endpoint to identify the consumer.

Why can't I use Authorization in Provider auth headers when OAuth is on?

The gateway sets Authorization: Bearer <consumer-token> on every request. If you also put Authorization in your Provider auth headers, the gateway overwrites it — your static key is lost. Use X-Provider-Key instead so both values reach your server without conflict.

How do I validate the OAuth token on my server?

// Call your OAuth provider's userinfo endpoint
const res = await fetch("https://api.github.com/user", {
  headers: { Authorization: req.headers["authorization"] },
});
if (!res.ok) return reply.status(401).send({ error: "Invalid token" });
const user = await res.json();
// user.login = GitHub username, user.id = GitHub user ID

import httpx
token = request.headers.get("Authorization")
r = httpx.get("https://api.github.com/user",
               headers={"Authorization": token})
if r.status_code != 200:
    return jsonify({"error": "Invalid token"}), 401
user = r.json()  # user["login"] = GitHub username

token := r.Header.Get("Authorization")
req, _ := http.NewRequest("GET", "https://api.github.com/user", nil)
req.Header.Set("Authorization", token)
resp, err := http.DefaultClient.Do(req)
if err != nil || resp.StatusCode != 200 {
    http.Error(w, "Invalid token", http.StatusUnauthorized)
    return
}

What does the Validate button do?

It calls your MCP's introspection endpoint (tools/list, prompts/list, resources/list) using the URL and headers you've configured, and reports back how many tools, prompts, and resources were found. This confirms the gateway can reach your server before you publish.

My MCP requires OAuth — how do I validate it?

Expand the Consumer OAuth section, enter your Token URL, Client ID, and Client Secret, then click Fetch token. The token fills in automatically. Then click Validate — the gateway calls your server with that token in the Authorization header.

Validation fails with 'Could not reach Token URL'

The token fetch goes server-to-server (Next.js → your OAuth server), so CORS is not an issue. Check that: (1) your OAuth server is running, (2) the Token URL is correct and publicly reachable, (3) your Client ID and Secret are valid.

Validation fails with 401 Unauthorized

Your MCP server rejected the request. Check that the Provider auth headers match what your server expects, and if OAuth is on, that the fetched token is valid and your server's token validation logic is correct.

Static API key only (no OAuth)

Per-user OAuth with GitHub

System-to-system with client_credentials (no user login)

Maximum security — both Provider key and Market verification