Solo-Founder MCP Marketplace: 9,248 Servers, 0 Verified
16 Aug 2026
A one-person company out of Wyoming has quietly built one of the larger Model Context Protocol (MCP) marketplaces in the ecosystem, hosting 9,248 MCP servers for use with agent tools like Claude Desktop, Cursor, Cline, Continue, and Aider. But the numbers behind the platform's security claims raise questions founders will want to weigh before wiring these skills into production systems.
What's on offer
AliceLabs LLC, founded in 2024 by Edison Flores, runs the marketplace as a single-founder operation — no employees, no investors, and no marketing budget. Despite the lean structure, the catalog is large: 9,248 total MCP servers, including 43 free skills that require no payment, signup, or credit card to try.
For skills that do require payment, AliceLabs offers two options: credit card via Stripe (with full chargeback rights) or USDC on Base L2, giving founders a choice between traditional buyer protections and a crypto-native path.
The security breakdown
AliceLabs markets its security layer around what it calls a Sentinel L2.5 security audit, which runs in a gVisor sandbox. But the review depth varies sharply across the catalog:
- 8,742 of 9,248 skills are auto-scanned by Sentinel with no human review.
- 22 skills are human-reviewed and curated as free offerings.
- 0 skills are maintainer-verified.
That means the overwhelming majority of the marketplace's inventory — roughly 94% — has passed through automated scanning only, with no human or maintainer sign-off. The report notes no technical detail is available on exactly how the Sentinel scan works beyond the sandbox reference, nor how the 22 human-reviewed skills were vetted differently from the auto-scanned bulk. There's also no independent or third-party audit of Sentinel L2.5 disclosed, and no adoption, download, or incident-history data to benchmark the security claims against real-world use.
Why founders should care
For early-stage teams evaluating MCP tooling, this combination of scale and thin verification is likely to matter in a few ways:
- Auto-scan is not the same as review. With 8,742 of 9,248 skills relying solely on automated scanning, founders should probably assume that sophisticated or novel threats could slip through — automated tools are generally weaker at catching context-specific or logic-based risks than human reviewers.
- Zero maintainer verification is a signal, not a dealbreaker. It doesn't necessarily mean the skills are unsafe, but it does suggest founders integrating any of these servers into critical workflows should plan on their own vetting rather than relying on the marketplace's badge system.
- Solo-founder scale could cut both ways. A single-person company may iterate quickly, but it may also have limited bandwidth to respond to a security incident affecting thousands of listed servers — something worth factoring into any risk assessment, especially for teams with compliance obligations.
- The free tier is a low-cost way to test the waters. The 43 no-signup free skills could be a reasonable, low-risk entry point for founders who want to experiment with MCP integrations before committing budget or production traffic.
The bottom line
AliceLabs has assembled a sizable MCP catalog with broad compatibility across popular agent frameworks and flexible payment rails — real conveniences for founders exploring agentic tooling. But the review report is clear that the security architecture leans heavily on automation: with 0 of 9,248 skills maintainer-verified and only 22 human-reviewed, founders would be well-served to treat the marketplace's security branding as a starting point for diligence, not a substitute for it.