What Kroy checks
Kroy runs automated checks when you submit a listing, when you choose Re-check, and every six hours for published remote servers. The results appear on the listing and in your dashboard.
Checks prove that a server answers and describes itself. They are not a security test.
Remote servers
Kroy connects as an ordinary MCP client, identifying itself as kroy-marketplace-check with the user agent KroyMarketplaceCheck/1.0.
| Check | Passes when |
|---|---|
| Public HTTPS endpoint | The URL uses https:// on a public host name (not an IP address, localhost or a private network). |
| Endpoint reachable | The server answers an MCP initialize request within 12 seconds. |
| MCP handshake | The response is a valid initialize result with serverInfo and a protocol version. |
| Tool list | tools/list returns tools, each with a description. No tools, or tools without descriptions, is a warning. |
| Tool annotations | Informational: how many tools are marked read-only or destructive, and how many are not marked. |
| Declared tools present | If you declared tools, they appear in what the server reports. Missing ones are a warning. |
Servers that need sign-in. If the server answers with 401 or 403, Kroy records that sign-in is required (and whether OAuth protected-resource metadata is published) and shows the tools you declared. That counts as reachable, not a failure.
Kroy calls initialize, notifications/initialized and tools/list, and ends the session. It never calls your tools.
Packages
| Check | Passes when |
|---|---|
| Package found | The package exists on npm, PyPI or Docker Hub under the name given. Other registries are checked by the reviewer. |
| Tool list | You declared the tools. Kroy does not run packages. |
Every listing
| Check | Passes when |
|---|---|
| Source repository | The repository link opens (a warning if not; no repository is fine). |
| Homepage, documentation | The links open (a warning if not). |
Statuses
- Pass: fine.
- Check: something a reviewer or user should know about, such as tools without descriptions.
- Note: information, not a problem.
- Fail: the server did not answer or did not speak MCP. A failing listing can still be submitted; the reviewer will see why it failed.
Allowing Kroy's checks
If your endpoint filters traffic, allow requests with the user agent KroyMarketplaceCheck/1.0. They come from Cloudflare's network. Checks are light: one handshake and one tool list, at most every six hours plus when you ask.