// About

How the catalog measures modules.

Open Mercato Modules lists the modules you can add to an Open Mercato app. It reads the published code of each module and installs each one in a new app on every Open Mercato version, nightly or weekly, to check that it still works. People and coding agents get the same data.

Release lines tested

Line	Open Mercato	Source	Cadence
`0.8`	`0.8.0`previous minor	npm previous minor	weekly
`0.9`	`0.9.0`latest release	npm latest	nightly
`next`	`0.10.1-develop.7701`develop snapshot	npm tag develop	nightly

// Data

Sources and rhythm

npm: new versions, release lines and the anatomy of new tarballs, every 6 hours at minute 17.
GitHub: repositories, claims and certified partners, every Monday at 04:17 UTC.
Nightly install: a fresh app per line, then every module, daily at 02:17 UTC; line 0.8 on Sundays; on next, the packages a new app already has on Sundays.
Two starter presets: a new app is what npx create-mercato-app makes, the classic preset, and its receipts give the verdict. An app from the empty preset installs the module without the rest of the platform: a second signal in isolation, never the verdict.

Data as of: npm 29 Oct 13:09 UTC, nightly 29 Oct 09:03 UTC. Data version 1.0.0-202610291638.h4a59fa.

// Execution

What runs where

Anatomy reads src/ of the published tarball with the Open Mercato fact extractor. The code is parsed, never executed.
The nightly install runs on disposable GitHub runners with no secrets and a read-only token. Module steps run as a separate user without sudo, with install scripts disabled. Status comes from the GitHub Actions API, not from files the module could write.
Only merged entries are installed at night. Pull requests are checked statically.
The MCP server is read-only: no install tool, no state, no authentication. Address: https://om-modules.openmercato.workers.dev/mcp.

// Cost

Cost and privacy

0 USD. GitHub Actions is free for public repositories, plus the Cloudflare Pages and Workers free tiers.
No analytics and no cookies. Pages load nothing from third parties.
Two exceptions, on your action only: Submit a module asks npm, jsDelivr and GitHub about the package you typed, and the demo on For agents loads this site's own data files.
Your theme choice is kept in your browser's local storage, nowhere else.

// Support

Report a problem

A wrong entry, a malicious or broken module: Report a module.
A vulnerability in this site, the data or the MCP server: private vulnerability reporting, see SECURITY.md.
Your own module: Submit a module, or a pull request with one file in modules/.

// License

License and maintainers

Code and data: MIT, copyright Open Mercato contributors. LICENSE
Module descriptions belong to their authors and are shown as plain text.
Maintained by the Open Mercato core team, in the repository on GitHub.