Is Smithery Worth It in 2026? Security, Licensing and Maintenance Compared
Smithery is worth it in 2026 if you want a mature, one-click registry that connects AI agents to 100K+ tools and skills with managed OAuth, credential storage and token-scoped access — its free Hobby plan includes 3 namespaces, with Pay-as-you-Go (100 namespaces) and Custom tiers above. For small businesses that specifically need to know which agent skills are safe and actually help, SkillzBench is building a free alternative: an independent directory that pins every skill version to a commit SHA, security-scans and license-checks it, and benchmarks each one in a sandbox — relevant because published research found ~26% of skills carry at least one vulnerability.
TL;DR
- Smithery is a live registry and hosting platform for MCP servers and skills, claiming 100K+ tools and skills, and was acquired by Arcade.dev on August 5, 2026.
- Smithery's free Hobby plan allows 3 namespaces; Pay-as-you-Go allows 100 and Custom allows 100+, but no specific dollar prices are published on a live pricing page.
- Smithery handles auth, credentials and sessions for you, including OAuth flows, credential storage, token refresh and scoped service tokens with TTLs.
- Smithery does not publish per-skill security scans or license checks; its per-server scores (e.g. 84/100, 77/100 shown on listings) don't explain their methodology.
- SkillzBench is a free, pre-launch directory that pins every skill version to a commit SHA, validates, license-checks, security-scans and quality-judges each one.
- SkillzBench plans to benchmark every skill in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points — and money never touches scores.
- Published research found ~26% of agent skills carry at least one vulnerability, which is the core risk both platforms address differently.
Head to head
| Dimension | Smithery | SkillzBench |
|---|---|---|
| Pricing | Free Hobby plan (3 namespaces); Pay-as-you-Go (100 namespaces) and Custom (100+) tiers exist, with no published dollar prices | Everything free — directory, MCP connector, benchmarks and alerts |
| Security | Managed OAuth, credential storage, end-to-end TLS for Uplink, scoped service tokens; no per-skill security scanning published | Security-scans every skill, pins versions to commit SHAs, and re-scans on upstream changes — built around the ~26% vulnerability finding 🏆 |
| Licensing | No license checking published for listed servers or skills | License-checks every skill as part of its Verify pillar 🏆 |
| Maintenance | Live platform, but acquired by Arcade.dev in August 2026 — roadmap consolidation under new ownership 🏆 | Plans automated upstream change tracking with re-scans, re-benchmarks and notifications; pre-launch |
| Benchmarking | Per-server scores shown on listings (e.g. 84/100, 77/100) without published methodology; Arcade's ToolBench exists separately | Sandboxed A/B benchmarks with the same model, with and without each skill, publishing Lift in percentage points 🏆 |
| Ease of use | One-click install, CLI with canonical workflows, piped JSONL output for scripting 🏆 | Per-agent loadouts and a single free MCP server planned; not yet usable |
| Maturity | Live registry with 100K+ tools/skills and servers showing 100k+ install counts 🏆 | Pre-launch; waitlist live, product not yet public |
| Integrations | Any MCP client; CLI, TypeScript SDK, cURL API; Uplink for local servers; MCPB bundles and Streamable HTTP publishing 🏆 | One free MCP server connecting any agent to chosen skills; supports Claude Code, Codex, Cursor, Gemini CLI and chat-app agents |
The contenders
Smithery is a public registry and hosting platform for MCP (Model Context Protocol) servers and AI skills, built around the idea that finding and running an MCP server should take one click. It markets itself as 'the marketplace for AI agents' with 100K+ tools and skills, and handles auth, credentials and sessions on the user's behalf. Developers get a CLI for searching, connecting and calling tools, namespaces for organizing servers, connections and skills, Uplink tunnels for exposing local servers, analytics for published servers, and scoped service tokens for fine-grained access control. In August 2026, Arcade.dev — an enterprise AI agent actions runtime focused on security, reliability and governance — acquired Smithery, with co-founder Anirudh Kamath joining the Arcade team. Arcade's own ToolBench benchmark found that MCP's growth has outpaced tool quality, which frames the acquisition's push toward production-grade trust.
pricing 0/month
- + Genuinely fast setup — one click from discovery to a running server, with a CLI and TypeScript SDK for programmatic use
- + Auth burden removed: OAuth flows, credential storage and token refresh are handled by the platform
- + Strong access-control primitives — service tokens can be scoped by namespace, resource, operation, metadata and TTL
- + Free Hobby tier gives small teams a real starting point (3 namespaces)
- + Broad ecosystem: popular servers like Brave Search (106.86k uses) and Gmail (59.79k uses) are listed with install counts
- + Backing from Arcade.dev adds an enterprise security and governance focus going forward
- − Acquired by Arcade.dev in August 2026 — product roadmap, pricing and feature consolidation under new ownership create uncertainty
- − No published per-skill security scanning or license checking; users must trust listed servers themselves (Smithery's own docs warn to 'only uplink servers you trust')
- − Per-server quality scores (e.g. 84/100) appear on listings without published methodology
- − Not open source — tokens& notes Smithery is not listed as open source, unlike several alternatives
- − Uplink availability follows the host machine — if the CLI is offline, calls fail; it's explicitly not a hosting solution
- − Third-party buyer guides flag setup complexity and a learning curve as common reasons users explore alternatives
SkillzBench is AIQ Labs' free, independent directory of AI agent skills — SKILL.md instruction packages for Claude Code, Codex, Cursor, Gemini CLI and chat-app agents — plus a free MCP tool that connects any agent to the skills you choose. It exists because agent skills are everywhere but nobody can tell which ones help and which are risky: published research found ~26% of skills carry at least one vulnerability. Its pillars are Discover (continuously crawl and dedupe skills from GitHub), Verify (pin every version to a commit SHA, validate, license-check, security-scan and quality-judge), Benchmark (test every skill in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points), Equip (one free MCP server plus per-agent loadouts where an agent only sees what was chosen), and Stay current (track upstream changes, re-scan, re-benchmark and notify). A 0-100 trust score combines security, quality, license, maintenance and community signals; Lift is always shown separately from ratings and money never touches scores. SkillzBench is pre-launch and actively being built — the waitlist is live, the product itself is not yet public.
pricing 0
- + Everything is free — the directory, the MCP connector, benchmarks and alerts; ad revenue never influences scores or listings
- + Security-first design directly targeting the finding that ~26% of skills carry at least one vulnerability
- + Version pinning to a commit SHA plus license checks gives auditable provenance for every skill
- + Sandboxed Lift benchmarks measure whether a skill actually helps, shown separately from ratings so money can't skew results
- + Per-agent loadouts mean an agent only sees the skills and tools explicitly chosen for it
- + Ongoing maintenance tracking: upstream changes trigger re-scans, re-benchmarks and notifications
- − Pre-launch — the waitlist/newsletter is live but the product itself is not yet public, so nothing can be used today
- − Focused on agent skills (SKILL.md packages) rather than being a general MCP server hosting platform
- − No live user counts, live skill counts or published benchmark results yet
- − A single free MCP server is a lighter integration surface than a full registry and hosting stack
Verdict
Winner: none
Smithery and SkillzBench solve different halves of the same problem: Smithery is a live, developer-focused registry and hosting platform (now part of Arcade.dev), while SkillzBench is a pre-launch, free verification and benchmarking layer for agent skills. They are complementary rather than direct substitutes.
| Option | Overall | Breakdown |
|---|---|---|
| Smithery | 7.5 | : 8: 9: 8: 7: 6 |
| SkillzBench | 7 | : 10: 6: 7: 9: 8 |
Security compared
Licensing and maintenance
Pricing compared
Which should you pick?
- :
- :
- :
- :
- :
FAQ
Is Smithery still worth using after the Arcade.dev acquisition?
Yes, for now. Smithery remains live and free to sign up, and Arcade.dev has stated it's investing in tool lifecycle management and enterprise-grade security. But the August 2026 acquisition means pricing, feature limits (like the 3-namespace Hobby cap) and the free tier could change under new ownership, so small businesses should avoid building deep dependencies on any single registry feature without a fallback.
Does Smithery check whether the skills and servers it lists are secure?
Smithery secures the connection layer — OAuth, credential storage, end-to-end TLS for Uplink, and scoped service tokens — but it publishes no per-skill security scanning or license checking. Its own documentation advises only running servers you trust, and Arcade's ToolBench benchmark found MCP tool growth has outpaced quality. That verification gap is exactly what SkillzBench is being built to fill.
How much does Smithery cost?
Smithery's Hobby plan is free and includes up to 3 namespaces. Pay-as-you-Go raises the limit to 100 namespaces and Custom to 100+, but no dollar prices for those tiers are currently published, so you'd need to check with Smithery for paid-tier costs.
Is SkillzBench free, and is it available now?
SkillzBench is completely free — the directory, the MCP connector, benchmarks and alerts all cost nothing, funded by advertising that never influences scores or listings. It is pre-launch and actively being built: the waitlist and newsletter are live, but the product itself is not yet public, so there are no live benchmark results or skill counts yet.
Can I use both Smithery and SkillzBench together?
Yes, and that's arguably the smart play. Smithery handles discovery, connection and hosting of MCP servers today, while SkillzBench's verification layer — commit-SHA version pinning, license checks, security scans and Lift benchmarks — addresses whether the skills you feed your agent are safe and effective. They operate on complementary layers of the same workflow.