io.github.thingery/thingery

{
  "mcpServers": {
    "thingery": {
      "command": "npx",
      "args": [
        "-y",
        "thingery@0.1.1"
      ]
    }
  }
}

{
  "mcpServers": {
    "thingery": {
      "command": "npx",
      "args": [
        "-y",
        "thingery@0.1.1"
      ]
    }
  }
}

{
  "servers": {
    "thingery": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "thingery@0.1.1"
      ]
    }
  }
}

code --add-mcp '{"name":"thingery","type":"stdio","command":"npx","args":["-y","thingery@0.1.1"]}'

claude mcp add --transport stdio thingery -- npx -y thingery@0.1.1

npx @modelcontextprotocol/inspector@2.11.0 -- npx -y thingery@0.1.1

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Facts about the publisher. We do not turn them into a trust score.

Source: the registry entry and api.github.com · 2026-10-23; security policy read from GitHub · 2026-10-23.

Publish this server? Run these checks against it yourself before release, from your own machine: a server the command starts, or your own server at its URL after a one-time proof that you control it: npx protocolprobe-selftest.

• io.github.PostHog/mcpPostHog MCP Servercompare with this one
• io.github.irinabuht12-oss/google-meta-ads-ga4-mcpGoogle Ads + Meta Ads + SEO/GEO MCPcompare with this one
• io.appllama/appllamaAppllamacompare with this one
• io.github.usertour/mcpUsertour MCP Servercompare with this one
• com.boostedchat/travelBoostedTravelcompare with this one
• io.github.LetsFG/letsfgLetsFG — Flights & Hotelscompare with this one

Active servers whose topic is also “commerce-and-marketing”, most GitHub stars first. The topic and the tool kinds are an AI model's reading of the publishers' descriptions, not checked by hand. Similar is not a recommendation.

No session

No session could be opened when we tried, so no check could run. No security score is given; a check we did not run is never counted as passed.

Why not security-tested: The server did not answer within our time limit; a longer limit or a retry is on us. — our limit

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). None of the 18 checks that apply to it could be exercised. We do not publish security-check outcomes for named servers.

Source: our own test in an isolated sandbox, 2026-10-23, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

The steps in order, as the test record holds them.

1. 0 msStarted the published package in an isolated sandbox
2. No session could be opened.
3. 128,444 msFinished: 0 checks exercised.

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.