The 'AI agent interceptor' is a 9,248-server marketplace, not a runtime filter

An 'AI agent interceptor' making the rounds is not a runtime filter at all. It is a marketplace, MarketNow, that audits 9,248 Model Context Protocol (MCP) servers before they ever reach an agent. The Hacker News launch thread and product copy called it an 'interceptor,' but the mechanism sits upstream of the agent, not in front of it.

MCP is the open standard that lets AI assistants like Claude Desktop, Cursor, Cline, Continue, and Aider plug into external tools and data sources. Each MCP server hands an agent access to files, APIs, or shell commands, which is the same access that makes them powerful and the same access that lets a sloppy or malicious server read a developer's .env file (a plain-text config that typically holds API keys, database URLs, and other secrets), exfiltrate data, or run destructive commands. As the server count climbs into the thousands, the security model has effectively become a buyer-beware catalog.

MarketNow's pitch is that it does the pre-flight work. The site claims every listed skill passes Sentinel L1.5, a 6-point MCP security audit, and Sentinel L2.5, a gVisor-based sandbox, before it ships. gVisor is Google's container-based isolation layer, the same kind of primitive used in production to keep workloads from escaping their boundaries. The audits are branded as AliceLabs's own standard, not a third-party certification, and the methodology is said to be published on the company's GitHub, though the repository surfaced in the Hacker News launch thread (edgarfloresguerra2011-a11y/marketnow) has not been confirmed as AliceLabs-owned.

The marketplace is a workaround for the absence of a runtime guard. A real interceptor would sit between the agent and the file system, blocking dangerous reads and shell calls as they happen. MarketNow does the equivalent work upstream, refusing to list a skill until it clears a vendor-defined checklist. That is a meaningful layer of friction, but it is not the same thing as a live filter on every command an agent runs, and the marketing does not always make that distinction.

The homepage breaks the 9,248 listed servers into AI/ML (1,976), Developer Tools (1,891), Data (782), Web/API (348), Productivity (328), Finance (292), Communication (288), and Security (224). Forty-three skills are free, with no payment or signup required, and install is a single command: npx -y @marketnow/install <slug>. The package also ships as marketnow-mcp on npm and on Smithery, a registry of MCP-compatible tools. Payment rails are Stripe, with chargeback rights, or USDC on Base, Coinbase's Layer 2 network.

The homepage advertises a '100% free' tier and lists 43 free skills, while the same page offers paid checkout through Stripe and USDC. The free tier is genuine (a small subset of skills requires no payment), but the homepage copy collapses the difference between 'free skills exist' and 'everything is free,' which is the kind of claim that should not survive contact with the API. A [/api/free-skills.json endpoint](https://marketnow.site/) and a separate /api/agent-purchase flow with five modes are both documented, and the platform's public API surface also includes /api/agent.json, /api/policies.json, and ACP/AP2-compliant mandate endpoints. None of that resolves the marketing tension.

The Sentinel tiering is self-published. No third party has audited the audit, and 'L1.5' and 'L2.5' are vendor labels, not industry standards. The gVisor sandbox tier is closer to a real isolation primitive, but it is still configured by the same vendor that grades the skill. The Hacker News launch thread is thin: a single anonymous comment, treated as community signal rather than corroboration, and a repository link whose ownership chain back to AliceLabs has not been independently verified.

For a developer trying to wire an agent into a real workflow, MarketNow is a real step up from pulling random MCP servers off GitHub. It is not the runtime guardrail the press implied. The 'interceptor' label, applied to MarketNow, is really a vetted catalog with a vendor-branded security tier and a checkout button. A runtime filter between the model and the shell is the part of the story that is still missing.