MCP Server Launch Checklist: Auth, Tools, Registry, Directories and Your Website

Before you launch a public MCP server, check six things: authentication, tool design, documentation for each AI app, your MCP Registry server.json, your directory submissions, and the website pages and metrics that follow. Each AI platform publishes its own rules, and they overlap enough that one pass can cover most of them.

This checklist pulls the requirements from Anthropic's connector docs, OpenAI's plugin docs, the MCP specification (version 2026-07-28) and the MCP Registry docs, all checked on 6 November 2026. Copy it into your launch plan and work through it in order.

It is a launch checklist, not a security audit. For a deeper security pass, use our MCP security checklist alongside it.

1. Server and transport

• Public HTTPS URL. Anthropic's submission guide asks for an https:// URL. OpenAI's submission page asks for "a stable, public HTTPS endpoint."
• Streamable HTTP. The registry's remote servers guide says remote servers "should use the Streamable HTTP transport" because SSE is deprecated. Anthropic's Software Directory Policy says SSE is acceptable for now but will be deprecated.
• A stable path. OpenAI's connect and test page says the endpoint is "typically at /mcp." OpenAI says changing an approved server's URL means contacting support, so pick it once.
• Reachable by the platforms. Anthropic's traffic comes from 160.79.104.0/21, per its authentication guide. Check that your firewall or WAF allows it, including in front of your identity provider.

2. Authentication and scopes

• OAuth for user accounts. Anthropic requires "OAuth 2.0 for authenticated services." OpenAI's portal supports OAuth, no auth, or mixed access, and has no API-key or bearer-token flow.
• PKCE S256. Anthropic says Claude sends a PKCE challenge with S256 on every authorization request, and your authorization server must support it.
• Redirect URIs. For Claude's hosted apps, register https://claude.ai/api/mcp/auth_callback. For Claude Code, accept a loopback redirect on any port for localhost and 127.0.0.1.
• Client registration. Claude supports DCR and CIMD by default. Anthropic suggests CIMD or Anthropic-held credentials for high-traffic servers, since DCR registers a client on every new connection. OpenAI's portal supports a registered client, DCR or CIMD.
• A 401 that points to metadata. Anthropic says a 401 is required to start sign-in, with a WWW-Authenticate header pointing to your protected resource metadata.
• Fast token endpoints. Claude waits up to 10 seconds on discovery, registration and token calls and 30 seconds on refresh.
• Refresh tokens. OpenAI's custom MCP help article warns that without offline_access, ChatGPT "may lose access after the original authorization expires."
• Least-privilege scopes. Request only the scopes your tools need. The MCP spec lets a server return only the tools a caller's granted scopes permit.

3. Tools: names, hints and descriptions

• Annotations on every tool. Anthropic's review criteria require a title and "readOnlyHint: true for read-only tools, and destructiveHint: true for tools that modify or delete data." OpenAI's plugin guidelines want readOnlyHint, destructiveHint and openWorldHint set "to explicit booleans."
• Short names. Anthropic requires 64 characters or fewer. The MCP spec tools page says names should be 1 to 128 characters using letters, digits, underscore, hyphen and dot. Aim for the stricter limit.
• Separate read and write. Anthropic rejects a tool that mixes safe and unsafe HTTP methods. OpenAI says "each model-callable operation must be its own tool."
• Accurate, plain descriptions. Both platforms reject descriptions that don't match behavior. Anthropic also rejects wording that steers Claude to other tools or promotes products. OpenAI rejects wording that steers the model to prefer your plugin.
• Useful errors. Anthropic fails tools that return generic errors such as "Internal Server Error." The MCP spec separates protocol errors from tool execution errors with isError: true, which give the model feedback it can act on.
• Sized responses. Anthropic asks for responses "reasonably sized for the task."
• No unsupported use cases. Anthropic doesn't accept connectors that transfer money or crypto, or generate images, video or audio with AI. OpenAI allows commerce only for physical goods.

Our guide to MCP tool annotations explains each hint.

4. Test before anyone reviews it

• MCP Inspector. The Inspector docs say it needs Node 22.19.0 or newer. For a remote server, run npx @modelcontextprotocol/inspector --server-url https://api.example.com/mcp --transport http.
• As a custom connector in Claude. Anthropic's portal asks you to confirm you ran every tool in Inspector or as a custom connector.
• As a custom MCP server in ChatGPT. OpenAI's connect page suggests positive, indirect, follow-up, write-action and negative prompts, and recording which tool was picked.
• Reviewer accounts. Anthropic wants credentials for "a fully populated account." OpenAI wants a demo account with sample data that works without MFA, email codes or magic links.

5. Documentation for each AI app

Each platform has its own install flow, so each needs its own page.

Anthropic says public documentation is required "by your publish date," and "A blog post or help-center article is sufficient."

6. Legal and trust pages

• Privacy policy. Anthropic requires one in the listing. OpenAI requires one covering data categories, purposes, recipients, retention and user controls, viewable before install.
• Terms of service, support URL and website. OpenAI's MCP review needs HTTPS websiteURL, supportURL, privacyPolicyURL and termsOfServiceURL, and says public URLs must "identify the same publisher as the submission."
• Verified identity. OpenAI requires verified individuals or organizations. Anthropic asks for verified contact and support channels.

7. MCP Registry server.json

• Write server.json with name, description and version, the three required fields in the 2025-12-11 schema. The schema caps description at 100 characters.
• Use a remotes entry with "type": "streamable-http" and your URL.
• Pick your namespace. A domain name such as com.yourcompany/server needs DNS or HTTP verification. GitHub names start with io.github..
• Validate it with our server.json validator, then publish with mcp-publisher.

Our step-by-step guide to publishing an MCP server to the registry covers the commands. Remember that Anthropic says registry publishing "doesn't surface your server in Claude."

8. Directory submissions

See how to get listed in Claude's connectors directory and how to submit an app to ChatGPT for each process. Other channels include Docker's catalog and paid marketplaces.

9. Website pages

Directories send people to your site, and AI search reads it. Plan these pages before launch:

• A product page for the MCP server that says what it does in plain words
• A setup page per AI app (from section 5)
• A tool reference with read/write labels
• A security page covering auth, scopes and data handling
• A changelog, since tool changes reach users without a reinstall on both platforms

Our guide to how to market an MCP server covers SEO and GEO for these pages.

10. Analytics and monitoring

• Server logs. Log tool calls, errors and latency on your side. The MCP spec says clients should log tool usage for audit, but you control your own server data.
• Claude's dashboard. Anthropic says a listed connector "has a dashboard with server health and usage by tool."
• ChatGPT changes. OpenAI scans your server daily after publication and holds flagged tool changes. Watch the portal after each deploy.
• Website analytics. Track visits to your setup pages and sign-ups that follow, so you can see which channel brings users.

Don't log more conversation data than your tools need. Anthropic's review rejects that, and OpenAI forbids reconstructing the full chat log.

Next step

eSEOspace's MCP marketing team builds the setup pages, docs and launch content in this checklist and handles directory submissions. If you still need the server itself, our MCP development team can build it. We scope each project individually and don't promise approval by any platform.

Frequently asked questions