Software that has been tested sells for more
List an agent, an app or an MCP server. It goes through the same 16-check rubric as everything else on the site, the result is published beside it, and buyers arrive already knowing what it does and what it does not.
Founding makers keep everything
No commission for the first six months. That is the whole liquidity hack: the earliest makers carry the least cost, because a listing nobody can find yet is worth the discount.
Payouts held, then released
A sale is held 14 days and then paid out. Long enough for the refund window to close, short enough that you are not financing the buyer.
One rubric, published
The same tests for everyone, versioned and public. You can read exactly what you will be measured against before you submit anything.
Pass first time
Three things fail more first attempts than everything else combined. Fix them before you submit and verification is usually quick.
- 01
A secret left in the repository history
Not just the current files: the git history. A key that was committed once and deleted later is still there, and the scan reads the whole log. Rotate anything that was ever committed and rewrite the history before you submit.
- 02
A manifest that does not match the software
The listing declares which tools it exposes, which scopes it needs and where it may send data. We compare that against what the software actually does, and a mismatch fails even when neither half is dangerous. Make the declaration true.
- 03
No declared egress list
Without a list of the hosts it may contact, the honest answer to what can leave is everything, and that is the single most common serious finding in this category. Declare the hosts you need; refuse the rest.