Build for Heimiro

Publish your MCP server as an app, or your bots as a recipe. Customers add it to a workspace and choose what their AI may do with each tool. No fee: if you charge, customers pay you directly.

How it works

You write a manifest: what the app is, where your server is, and every tool it has.
We check it right away. Your server’s address must have your developer code, so nobody can publish a server that isn’t theirs. The tools on your server must match the manifest. Sign-in must work: with OAuth you sign in to your own app once during the check, and we use that token only to list your tools. And every tool’s name, description and input schema is read for hidden instructions to the AI. Write it all in English; write to us if you need another language.
If it passes, it’s on the shelf, marked Not verified until we’ve reviewed it. Every tool starts on Ask first, so nothing your app does runs before the customer allows it.
Each time a customer refreshes your tools, we read them again and check your developer code. If your server shows something that doesn’t pass, that customer keeps what passed before, and you and we see it on the app’s page. If your server shows customers something other than what it showed the check, we stop the app.
You can unpublish any time, and it stops for every customer at once. We can stop an app too, and we tell you why on its page.

Not allowed

Text written to the AI instead of the person: orders, hidden characters, tags or comments, encoded text.
Telling the AI how to use other tools or apps, or to send what it knows anywhere.
Asking for passwords, keys or files, or links to sites that aren’t yours in tool text.
Using our name, or someone else’s, as yours, or an app name like System, Assistant or Admin.

The full developer terms are being written. Until they’re published, publishing is open to a few developers. Questions: hab@viit.no.

The manifest

name: What customers see on the shelf. Up to 60 characters.
developer: Your name or company.
description: What the app does, in a sentence or two.
data: Where the data is kept and what is sent to you.
website: Your website, https.
address: Your MCP server (Streamable HTTP), https. It can't change once published.
sign_in: oauth or none. With oauth, every customer signs in to their own account at your app.
tools: Every tool your server lists, with reads: true only when the tool just reads. It must match the tool's readOnlyHint.