# How to submit an MCP server to cursor.directory By [Jonah Ease](https://manycp.com/about) Published 1 Oct 2026 Last checked 1 Oct 2026 cursor.directory lists plugins, and an MCP server goes in as a component of one. The way in is the page `/plugins/new`, which sends you to sign in with GitHub or Google first[9]. Then you paste a repository and let the form detect what is in it, or fill the fields in yourself, and a security scan decides what happens next. ## Auto or Manual The form has two tabs, Auto (GitHub) and Manual[2]. Auto asks for a GitHub URL and a button labelled Scan repo. It looks for these files[1]: | Component | Path | | --- | --- | | MCP servers | `.mcp.json` (or `mcp.json`) | | Rules | `rules/*.mdc` | | Skills | `skills/*/SKILL.md` | | Agents, hooks, LSP | `agents/*.md`, `hooks/hooks.json`, `.lsp.json` | Detection follows the Open Plugins standard; read 1 Oct 2026 [1] [3] Manual asks for a name (at least 2 characters), a description (at least 10), optional repository and homepage URLs and keywords, and at least one component[4] [2]. Either way, you click Publish Plugin yourself. ## The scan, and what the banner says Submitted plugins are reviewed by an automated agent against a fresh clone of the repository, which returns a verdict of safe, suspicious or malicious[1]. The plugin page shows the state to its owner[6]: - _Scanning your plugin… it will appear publicly once the security agent finishes_ - _Scan failed. An admin will re-run it shortly_ - _Flagged by the security agent_, with the plugin hidden pending manual review. The owner can edit the plugin and resubmit to trigger another scan. The scan's instructions name the categories it looks for: malicious code, prompt injection, spam, NSFW content, impersonation and low quality. It also compares your plugin's name with existing active plugins, and a name collision alone is not disqualifying; it flags a substantive copy, or something that masquerades as an official or well-known plugin[5]. A safe verdict makes the plugin live, and in that code path no person is involved. A flagged new plugin stays hidden until someone reviews it; one that was already live is only taken down for a malicious or high-severity verdict, and lower ones go to the review queue[5]. ## Messages you can get, and who waited | Message | What to do | | --- | --- | | Invalid GitHub URL. Expected format: https://github.com/owner/repo | Paste the repository root, not a subpage | | Could not read repository… | Make the repository public and check the URL | | No plugin components found… | Add one of the paths in the table above and push, then scan again, or use Manual | | A plugin with this name or repository already exists | Pick another name, or check whether the repository is already listed | | Too many plugin submissions in the last hour | Wait and try again | Wording from the form's source code[3] [4] The tracker shows the waits. On 14 Sept 2026 a submitter had 18 plugins stuck on "Scan failed" with no way to rescan[7], and another plugin sat flagged and hidden from 11 Sept 2026 with the author bumping the thread on 22 and 29 Sept[8]. ## By hand Sign in, paste the URL, click Scan repo, check the detected components, and click Publish Plugin. If your repository has no `.mcp.json`, adding one at the root takes a minute; detection looks in a fixed set of paths. ## Current status, 1 Oct 2026 The directory's code moved to [cursor/community-plugins](https://github.com/cursor/community-plugins), where the latest change I saw was merged on 11 Sept 2026 and GitHub counted 23 open issues and pull requests[1]. No page I found gives a review time. ## Sources 1. [cursor/community-plugins: README (submission and scan)](https://github.com/cursor/community-plugins/blob/main/README.md) · checked 1 Oct 2026 2. [cursor/community-plugins: the plugin form (plugin-form.tsx)](https://github.com/cursor/community-plugins/blob/main/apps/cursor/src/components/forms/plugin-form.tsx) · checked 1 Oct 2026 3. [cursor/community-plugins: repository scan (parse.ts)](https://github.com/cursor/community-plugins/blob/main/apps/cursor/src/lib/github-plugin/parse.ts) · checked 1 Oct 2026 4. [cursor/community-plugins: create-plugin action](https://github.com/cursor/community-plugins/blob/main/apps/cursor/src/actions/create-plugin.ts) · checked 1 Oct 2026 5. [cursor/community-plugins: the scan (scan.ts)](https://github.com/cursor/community-plugins/blob/main/apps/cursor/src/lib/plugins/scan.ts) · checked 1 Oct 2026 6. [cursor/community-plugins: scan status banner](https://github.com/cursor/community-plugins/blob/main/apps/cursor/src/components/plugins/detail/scan-status-banner.tsx) · checked 1 Oct 2026 7. [cursor/community-plugins issue 436: 18 plugins stuck on Scan failed](https://github.com/cursor/community-plugins/issues/436) · checked 1 Oct 2026 8. [cursor/community-plugins issue 433: a plugin flagged and waiting for manual review](https://github.com/cursor/community-plugins/issues/433) · checked 1 Oct 2026 9. [cursor.directory: sign in to submit plugins](https://cursor.directory/login?next=/plugins/new) · checked 1 Oct 2026 ManyCP is not affiliated with, endorsed by or sponsored by any directory, Docker, OpenAI, Anthropic or GitHub named here. Names are used to say which service a fact is about. --- Source: [ManyCP](https://manycp.com/directories/cursor-directory)