shouldiuse.io

Categories

VERDICT

Should I use Smithery?

Connect agents to services in minutes - smithery.ai

Depends. Buy if you're a developer who wants a large MCP registry with quick installs and hosting. Skip if you need a vetted, production-grade vendor — it has a security incident history and zero third-party reviews.

Confidence

Medium. Based on 40+ public sources; many snippets were truncated, so ratings and pricing stay unclaimed where unconfirmed.

Ratings

  • Value for moneyPricing unclear; users ask how it sustains hosting
  • Ease of useMarketing promises fast setup; little independent confirmation
  • Feature depth
  • Support qualityNo evidence either way
  • Security posture

Pricing

Not disclosed

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed

Best for

  • Developers wiring AI agents to tools
  • MCP server authors seeking distribution
  • Teams wanting hosted MCP servers
  • SMB dev teams experimenting

Not for

  • Non-technical teams — useless without a developer
  • Anyone connecting unvetted servers to production credentials
  • Enterprises needing vendor maturity, SLAs, compliance history
  • Buyers who want reviewed marketplaces — zero G2 reviews

Gotchas - check before you buy

high

Third-party servers carry supply-chain risk; vet before connecting production credentials

medium

Pricing opaque enough that the community debates how hosting is funded

medium

Acquired by Arcade in Aug 2026; roadmap and pricing could shift

medium

Platform stores your credentials for hosted servers; review its security page first

Pros and cons

Pros

  • Large registry: 2,000+ MCP servers
  • One CLI installs servers across MCP clients
  • Hosted MCP option removes local server management
  • Free security scanning via Invariant Labs partnership
  • Publishes a public security page

Cons

  • 2025 path-traversal flaw exposed ~3,000 hosted servers
  • Independent scan flagged 22 of top 100 servers
  • Zero G2 reviews; buyers rely on Reddit anecdotes
  • Some installed servers exposed zero working tools
  • Monetization unclear; users question long-term viability

Sources & method

Analyzed 10/01/2026 - 14 sources - One critical path-traversal flaw, fixed October 2025, exposed ~3,000 hosted MCP servers; third-party server quality is largely unvetted.

official x4review x5security x4news x1
  • Path traversal flaw exposed ~3,000 MCP servers, Disclosed October 2025; Smithery fixed it before exploitation, per reporting and GitGuardian's write-up.
  • Independent scan flagged 22 of top 100 servers, A community scan of 100 Smithery-hosted servers flagged 22 for issues.

Key stats

  • Feature depth: 4/5

    Rating

  • Not disclosed

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money. Pricing unclear; users ask how it sustains hosting
  • Ease of use. Marketing promises fast setup; little independent confirmation
  • Feature depth: 4/5. Registry, hosted servers, CLI, skills, security scanning
  • Support quality. No evidence either way
  • Security posture: 2/5. Path-traversal flaw; 22 of 100 servers flagged
  • 2,000+ MCP servers listed community-reported, 2025
  • 0 G2 reviews no rating yet
  • by Arcade, Aug 2026 Acquired per Forbes
  • South Park Commons Backing per Crunchbase

Pricing

Not disclosed

Security

One critical path-traversal flaw, fixed October 2025, exposed ~3,000 hosted MCP servers; third-party server quality is largely unvetted.

  • Path traversal flaw exposed ~3,000 MCP serversDisclosed October 2025; Smithery fixed it before exploitation, per reporting and GitGuardian's write-up.⁴
  • Independent scan flagged 22 of top 100 serversA community scan of 100 Smithery-hosted servers flagged 22 for issues.⁶

What users say

Reddit chatter is mixed: developers like the breadth but repeatedly question trust, reliability, and how the hosting is funded.

“is smithery.ai reliable and can be trusted?”
Reddit, r/mcp
“Be careful with using Smithery”
Reddit, r/mcp
“AI: all smithery mcp servers have 0 tools available”
GitHub, zed-industries issue
Full analysis

Based on 40+ public sources; many snippets were truncated, so ratings and pricing stay unclaimed where unconfirmed.

Big MCP registry, easy installs, but a 2025 security flaw and zero reviews make it a bet, not a safe pick.

Methodology

Based on 40+ public sources; many snippets were truncated, so ratings and pricing stay unclaimed where unconfirmed.

Sources

  1. Smithery homepagesmithery.ai
    official
  2. Smithery security pagesmithery.ai
    official
  3. Smithery pricingsmithery.ai
    official
  4. Smithery fixes path traversal flaw exposing 3,000 MCP serversscworld.com
    security
  5. From Path Traversal to Supply Chain Compromise (GitGuardian)blog.gitguardian.com
    security
  6. We scanned 100 Smithery MCP servers, 22 flaggednews.ycombinator.com
    security
  7. Arcade acquires Smithery (Forbes)forbes.com
    news
  8. Smithery AI: a central hub for MCP servers (WorkOS)workos.com
    review
  9. Is smithery.ai reliable and can be trusted?reddit.com
    review
  10. Smithery Products on G2 (0 reviews)g2.com
    review
  11. How does smithery make money?reddit.com
    review
  12. Smithery serving 2K+ MCP serversreddit.com
    review
  13. @smithery/cli on npmnpmjs.com
    official
  14. Invariant Labs partnership: Smithery MCP Scaninvariantlabs.ai
    security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.