How to sell MCP servers
Updated 14 October 2026
Short answer
To sell an MCP server, ship it as installable source or a release package with a permissions manifest that lists the tools, network access and credentials it uses. Add clear install docs for the common MCP clients, and use a licence that allows commercial use. Because MCP servers run with real access to systems, buyers care about security first: declare every permission, use least-privilege tokens and get it reviewed. Typical prices are $29–$149, or a subscription when you host it.
What to package
- Source code or a versioned release (npm, PyPI, Docker image or ZIP)
- A permissions manifest: tools exposed, read or write access, network hosts and required credentials
- Install and configuration docs for popular MCP clients
- A test suite or reproducible demo, plus a changelog
Step by step
- 1
Solve an integration buyers can't easily build
The best candidates connect agents to an internal tool, a niche API or a complex workflow, where a buyer would otherwise spend days on integration.
- 2
Design tools with least privilege
Split read and write tools, require explicit confirmation for destructive actions, and accept scoped tokens rather than admin keys.
- 3
Declare everything
Document every outbound host, file path and credential. Undeclared network calls are the fastest way to lose buyer trust.
- 4
Choose a licence and delivery model
A one-time licence with source works for self-hosted use. A hosted MCP server suits a subscription, but then you operate the infrastructure.
- 5
Get a security review
Scan dependencies and secrets, and have someone review that the declared permissions match the code. BotAisle requires human review before an MCP server is listed.
- 6
Publish docs and a demo
Show a real agent session using the server. Developers buy what they can see working.
Pricing guidance
- Small single-API server: $19–$49
- Multi-tool server with auth and tests: $49–$149
- Team or commercial licence with support: $149–$499
- Hosted MCP server: monthly subscription priced on usage and support
Where to sell: options compared
| Option | Fees | Pros | Cons |
|---|---|---|---|
| BotAisle | 20% on paid sales; 0% on free listings | Built for AI artifacts (skills, MCP servers, workflows, bots); security review on every listing; six-language storefront; free listings allowed | Pre-launch, so no buyer traffic yet; payouts are net 30 after the month of sale |
| Gumroad | 10% + $0.50 per direct sale plus card processing; 30% on Discover marketplace sales | Very quick to set up; merchant of record (handles sales tax/VAT); well known to buyers | Not specific to AI; no security review of code; you bring most of the traffic yourself |
| Lemon Squeezy | 5% + $0.50 per sale; surcharges for international cards, PayPal and subscriptions | Low fees; merchant of record; licence keys and subscriptions built in | Checkout tool rather than a discovery marketplace; ID and business review before going live |
| PromptBase | 20% on marketplace sales; 0% via your referral link | Established buyer audience for prompts | Focused on prompts; not suited to code, MCP servers or workflows |
| Your own site (e.g. Stripe Checkout) | Card processing only (roughly 3% + $0.30); you handle tax | Full control, branding and customer data; lowest per-sale fees | You build delivery, licensing, tax compliance and traffic yourself |
Fees are as published by each provider in October 2026 and can change. Check their pricing pages before you decide. BotAisle is pre-launch: it is accepting founding creators but doesn't have buyer traffic yet.
Frequently asked questions
- Can I sell an open-source MCP server?
- Yes, if the licence allows it. Many sellers keep a free open-source core and sell a pro version, a hosted version, support or commercial licences.
- What do buyers check before installing an MCP server?
- The permissions it requests, outbound network calls, how it stores credentials, and whether it has been maintained recently. Make all of that easy to find.
- Is a security review a guarantee?
- No. A review lowers risk but can't guarantee code is free of vulnerabilities. Buyers should still use scoped credentials and test in a safe environment.
- How are MCP servers reviewed on BotAisle?
- Every upload gets automated scanning. MCP servers also get a human review that checks the declared permissions against what the code actually does, before they're listed.