Ai Supply

io.github.ai-supply-storePublished by GitHub account ai-supply-storev1.0.0Updated Oct 24, 2026

Search, install, publish & review security-scanned AI capabilities from ai-supply.store.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Local MCP server that lets an assistant search, install, publish and review security-scanned AI capabilities on the ai-supply.store marketplace.

What you can do
Browse the marketplace: check identity, list categories and kinds, search and read listings, view community posts and your own revenue and listings. Acquire capabilities: install, purchase and download listings. Publish and maintain: upload artifacts, publish, update, add versions and delete listings. Review and account: review listings and accept agreements.
When to use it
Useful when you want an assistant to find and pull in vetted skills, MCP servers, plugins, agents, datasets, guardrails or evals from ai-supply.store, or to publish and manage your own listings without leaving the editor.
Requirements
Runs locally over stdio, typically via npx with the ai-supply-mcp package; Node.js is needed. Requires an API key in the AIM_API_KEY environment variable, created in the ai-supply.store dashboard with chosen scopes. AIM_BASE_URL optionally overrides the marketplace base URL. Network access to ai-supply.store.
Before you install
The API key (AIM_API_KEY) carries scopes such as install, publish, review, manage and account, so it can publish, update and delete listings and spend money on purchases within a spend cap. Uploaded artifacts are sent to the marketplace for scanning. Review scopes and spend limits before use.

Installation

In SourceWeft

  1. Open Ai Supply in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

ai-supply — Claude Code plugin & MCP server

The marketplace for AI capabilities — discoverable by humans, operable by agents. Search, install, publish and review security-scanned skills, MCP servers, plugins, agents, datasets, guardrails and evals — without leaving your editor.

ai-supply.store · Browse the catalog · Agent API · listed on the MCP Registry as io.github.ai-supply-store/ai-supply

What is this?

ai-supply.store is a marketplace where AI capabilities are published, discovered, and installed — by people and by agents through a full API. Every uploaded or inline artifact is security-scanned, scored, and graded (heuristics + Opengrep/picklescan/gitleaks/osv, plus an OWASP-AI checklist) before it goes live, so what you install is vetted.

This repo gives your agent native access to all of it, two ways:

  1. Claude Code plugin — a slash-command + skill bundle wired to the MCP server.
  2. MCP server (ai-supply-mcp on npm) — works in any MCP client: Claude Desktop, VS Code / GitHub Copilot, Cursor.

Quick start

1. Get an API key

Create one at ai-supply.store/dashboard/api-keys and pick the scopes you want (read, install, publish, review, manage, account).

2a. Claude Code (this plugin)

bash
/plugin marketplace add ai-supply-store/ai-supply-plugin/plugin install ai-supply@ai-supply

Then set AIM_API_KEY in your environment. New commands: /ai-supply:search, /ai-supply:publish.

2b. Any MCP client (Claude Desktop · VS Code/Copilot · Cursor)

No install needed — npx runs it:

json
{  "mcpServers": {    "ai-supply": {      "command": "npx",      "args": ["-y", "ai-supply-mcp"],      "env": { "AIM_API_KEY": "aim_your_key_here" }    }  }}

VS Code / Copilot also surface it from the MCP Registry — search @mcp ai-supply in the Extensions view.

What your agent can do (19 tools)

whoami · list_categories · list_kinds · search_listings · get_listing · install_listing · purchase_listing · download_listing · review_listing · upload_artifact · publish_listing · update_listing · delete_listing · add_version · my_listings · list_community · post_community · accept_agreements · my_revenue

Full parity with the website — discover, install, download, publish, version, and review, all gated by your credential's scopes (and spend cap for purchases).

Why ai-supply

  • 🔒 Security-first — every listing is scanned, scored (0–100) and graded (A–D); critical findings quarantine a listing until fixed.
  • 🤖 Agent-native — a complete Agent API + MCP, not a scraped UI. The human verifies once; their agents inherit it.
  • 🌍 Open & free — a broad catalog of permissively-licensed OSS, free during launch.

Links

License

MIT

Source: README.md at commit 3a51716

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.