I have two MCP servers waiting in the Connectors Directory review queue right now, so I went through Anthropic's published criteria line by line and turned them into a checklist. Everything below comes from the official docs (links at the end). I do not know the inside of the review, only what Anthropic publishes, and I cannot promise acceptance for anyone, including myself.
Split read and write tools. A single tool that accepts both safe HTTP methods (GET, HEAD, OPTIONS) and unsafe ones (POST, PUT, PATCH, DELETE) is rejected. No catch-all api_request tool with a method parameter. Writing "safe versus unsafe" in the description does not count; the operations must be separate tools, ideally split further into create, update and delete.
Annotate every tool. Each tool needs a title and readOnlyHint: true or destructiveHint: true. Read-only tools can run without per-call confirmation, destructive ones always prompt.
Name the API in custom query tools. If a tool takes freeform paths, query strings or bodies, its description must link to or name the target API. "Makes a request to the API" fails.
Keep tool names to 64 characters or fewer and descriptions accurate. The description has to match what the tool really does.
Remove anything that tells Claude how to behave. Descriptions are rejected if they tell Claude to call tools the user did not ask for, interfere with other tools, pull instructions from external sources, hide or encode instructions, override system instructions or promote products.
Make errors useful. "Internal Server Error" with no detail fails. Validate inputs and return messages that say what to fix. Do not return a full database dump when a summary was asked for.
Do not collect more than the tool needs, and never query Claude's memory, chat history or the user's files.
Prepare the submission pieces: an HTTPS remote URL, OAuth 2.0 if tools act on a user account, a fully populated test account, public documentation by your publish date, a privacy policy, a support contact and an icon.
Test every tool twice: in MCP Inspector and as a custom connector inside Claude. The portal asks you to confirm it.
Anthropic requires servers to meet its security standards and to respond to security issues promptly. The two classic mistakes in MCP code are passing a caller's URL straight to fetch (server-side request forgery) and building a shell command from a tool argument. A free static scanner I wrote checks for both, plus leaked keys: https://gitlab.com/florin-builds/mcp-ssrf-scan. It finds patterns, not proof. On 36 public servers it produced mostly noise, so read every hit.
If you would rather have a person do the pass, I offer a fixed-price review: https://audit.flo-voice1.com Sources: Anthropic docs, "Connector pre-submission checklist" and "Submit a connector to the directory" (https://claude.com/docs/connectors/building/submission).