How to submit an MCP server to Smithery

Smithery lists servers that already run somewhere. You give it a public address, it connects to that address, reads what the server offers, and builds the listing from what it finds. There is no pull request and no reviewer in the route^[1]. That makes the scan the whole story: when it reads your server, you are listed, and when it cannot, you get an error that names what it ran into.

Three ways to publish

Source: Smithery docs, read 1 Oct 2026^[1][2]. The CLI installs with npm install -g smithery@latest and needs Node.js 20 or newer; smithery auth login signs you in.

An npm package or a stdio server cannot go in by URL. It needs the bundle route^[1].

What the scan reads

Smithery connects and extracts your tools, prompts and resources for the server page. A public server finishes by itself. A server behind sign-in pauses and asks you to authenticate so the scan can finish^[1][4]. The release then moves through the statuses Smithery's API reports:

QUEUED  WORKING  SUCCESS  FAILURE  FAILURE_SCAN
AUTH_REQUIRED  AUTH_TIMEOUT  CANCELLED  INTERNAL_ERROR

Read 1 Oct 2026^[3]. FAILURE_SCAN and AUTH_REQUIRED are the two to expect when your server is not open to a stranger.

Why the scan fails

Smithery's troubleshooting section names one error for a refused scan: Initialization failed with status 403. It lists three causes^[1]:

• Bot protection. Smithery calls with the user agent SmitheryBot/1.0 (+https://smithery.ai) from Cloudflare Workers, which some firewalls block by default.
• 403 where a 401 belongs. An unauthenticated call to an OAuth server should get 401, which is how a client starts OAuth discovery^[5]. A 403 is for a token that lacks scope, so Smithery sees a closed door and no way to knock.
• IP allowlists that leave Smithery's range out.

Check your own server first

curl -i -X POST https://weather.example.com/mcp \
  -H "content-type: application/json" \
  -H "user-agent: SmitheryBot/1.0 (+https://smithery.ai)" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

# a server that needs OAuth should answer:
# HTTP/2 401
# www-authenticate: Bearer resource_metadata="https://weather.example.com/.well-known/oauth-protected-resource"

Cloudflare Bot Fight Mode

Cloudflare says Bot Fight Mode cannot be skipped with WAF custom rules, because it does not run on the ruleset engine^[6]. Smithery's docs name three ways out on the free plan: add an IP Access Rule for Smithery's range, switch Bot Fight Mode off for all traffic, or move to the Pro plan at $20 a month, which has Super Bot Fight Mode and skip rules (Smithery's docs, 1 Oct 2026)^[1]. On Pro, the rule is (http.user_agent contains "SmitheryBot") with action Skip.

The fallback: a server card

When the scan cannot finish, serve the metadata yourself at /.well-known/mcp/server-card.json. Only serverInfo is required. The shape follows the TypeScript SDK's types and comes from a proposal, SEP-1649^[1][7].

{
  "serverInfo": { "name": "Weather", "version": "1.0.0" },
  "authentication": { "required": true, "schemes": ["oauth2"] },
  "tools": [
    {
      "name": "forecast",
      "description": "Forecast for a city",
      "inputSchema": {
        "type": "object",
        "properties": { "city": { "type": "string" } },
        "required": ["city"]
      }
    }
  ],
  "resources": [],
  "prompts": []
}

Doing it by hand

1. Check the probe above returns what your server should return.
2. Open smithery.ai/new and sign in.
3. Paste the URL and work through the form.
4. If the release stops at AUTH_REQUIRED, authenticate when Smithery asks.
5. Afterwards, open Settings, then Verification on the server's page for the official-vendor checklist^[1].

You press the final button on Smithery's form yourself, and the sign-in is yours.

Current status, 1 Oct 2026

Smithery's publish page documents URL publishing with the scan, the CLI, MCPB bundles and the server card, and describes no review step and no listing fee^[1].