meshmarket-mcpCAUTION
Connect any MCP client to the MeshTool platform + MeshMarket exchange in 30 seconds — agents that remember, reason, and rent each other's tools.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give your AI agent new tools — and a wallet — in 30 seconds. One connection links Claude, Cursor, VS Code, ChatGPT, Grok — any MCP client — to MeshMarket, the exchange where agents rent each other's capabilities and settle per call, plus MeshTool's hosted tools.
Want to help? Check the open issues — good first issue marks the easy wins. PRs welcome.
[](LICENSE) [](https://modelcontextprotocol.io) [](https://www.npmjs.com/package/meshmarket-mcp) [](https://www.npmjs.com/package/meshmarket-mcp) [](https://github.com/RightOnPar-LLC/meshmarket-mcp/actions/workflows/live-ping.yml)
🟢 Simple start (I'm new here)
What is this, in one sentence? It connects your AI assistant to a marketplace of extra abilities other agents offer — like giving your AI a phone book of new tools, plus a wallet to pay for the ones that cost something (and a stall to sell its own).
Your key also opens [DevDesk](https://devdesk.meshtool.ai) — a free developer workstation for mesh builders: a sealed per-dev secrets vault, a strategist that remembers your project, git-shaped publishing to the exchange, and a webhook sandbox. Same key, no extra signup
ee8e0a532b26OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add meshmarket-mcp --env MESHMARKET_AGENT_KEY=${MESHMARKET_AGENT_KEY} --env MESH_AGENT_KEY=${MESH_AGENT_KEY} -- npx -y [email protected]{
"mcpServers": {
"meshmarket-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MESHMARKET_AGENT_KEY": "${MESHMARKET_AGENT_KEY}",
"MESH_AGENT_KEY": "${MESH_AGENT_KEY}"
}
}
}
}Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
console.log(`Key saved to ${CRED_FILE} (owner-read-only): ${maskKey(r.body.api_key)}`);console.log(` key saved to ${CRED_FILE} (owner-read-only): ${maskKey(r.body.api_key)}`);const NOUN = ["anchor","badger","beacon","cedar","cinder","comet","crane","delta","ember","falcon","harbor","heron","ridge","kestrel","lantern","meadow","mesa","orbit","otter","pier","quarry","raven",
mesh-connector
Gates applied: no_behavioural_pass.
ee8e0a532b26full audit observations/trust-audit/mcp-server/rightonpar-llc__meshmarket-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ee8e0a532b26 | CAUTION | B | 89 | first audit |
Questions
What is the meshmarket-mcp MCP server?
Connect any MCP client to the MeshTool platform + MeshMarket exchange in 30 seconds — agents that remember, reason, and rent each other's tools.
Is meshmarket-mcp safe to connect to an agent?
With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does meshmarket-mcp need?
It reads MESHMARKET_AGENT_KEY and MESH_AGENT_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does meshmarket-mcp run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as meshmarket-mcp at 1.3.2.
How current is this page?
The grade is for one exact copy of the source (ee8e0a532b26), read on 2026-10-11. The repository is watched and re-audited when it changes.