MCP listing remains not_validated after successful publish/update, with no validation error exposed

[sebit-provider]

I published an MCP server to the LobeHub Marketplace using @lobehub/market-cli.
The listing is successfully claimed and the CLI accepts both the initial publish and a subsequent version update, but the listing remains permanently in:
status: not_validated

No validation error, reason, or diagnostic information is exposed by the CLI.
The MCP server itself is live and has already been tested successfully with external MCP clients.
Listing information
{
"id": 89390,
"identifier": "cajas-mcp",
"name": "CAJAS MCP",
"isClaimed": true,
"latestVersion": "0.1.1",
"status": "not_validated"
}

Repository:
https://github.com/sebit-provider/cajas-mcp

MCP endpoint:
https://sebit-mcp.com/mcp

Current lhm.plugin.json
{
"identifier": "cajas-mcp",
"name": "CAJAS MCP",
"version": "0.1.1",
"description": "Vendor-neutral MCP adapter for CAJAS accounting workflows. Requires a CAJAS account and a CAJAS MCP personal access token or OAuth-capable MCP client.",
"author": "SEBIT",
"avatar": "https://raw.githubusercontent.com/sebit-provider/cajas-mcp/main/assets/cajas-icon.png",
"icon": "https://raw.githubusercontent.com/sebit-provider/cajas-mcp/main/assets/cajas-icon.png",
"homepage": "https://github.com/sebit-provider/cajas-mcp#readme",
"repository": {
"type": "git",
"url": "https://github.com/sebit-provider/cajas-mcp"
},
"license": "UNLICENSED",
"tags": [
"mcp",
"accounting",
"cajas",
"assembly",
"raw-import",
"coa"
],
"mcp": {
"type": "http",
"url": "https://sebit-mcp.com/mcp",
"transport": "streamable-http",
"auth": {
"type": "bearer",
"header": "Authorization",
"description": "Use a CAJAS MCP personal access token from your CAJAS account settings. Header value format: Bearer ."
}
}
}

Reproduction
Initial publish:
npx -y @lobehub/market-cli plugin publish https://github.com/sebit-provider/cajas-mcp

This succeeded and created version 0.1.0.
The listing then appeared in:
npx -y @lobehub/market-cli plugin list --output json

with:
{
"identifier": "cajas-mcp",
"isClaimed": true,
"latestVersion": "0.1.0",
"status": "not_validated"
}

I then changed only the version in lhm.plugin.json from:
0.1.0

to:
0.1.1

and ran:
npx -y @lobehub/market-cli plugin update

The CLI confirmed:
Updated cajas-mcp (0.1.0 → 0.1.1)

After the update:
npx -y @lobehub/market-cli plugin list --output json

returns:
{
"createdAt": "2026-08-16T09:52:26.897Z",
"id": 89390,
"identifier": "cajas-mcp",
"isClaimed": true,
"latestVersion": "0.1.1",
"name": "CAJAS MCP",
"status": "not_validated",
"updatedAt": "2026-08-25T10:19:29.339Z"
}

Server behavior
The endpoint is intentionally authenticated.
An unauthenticated request to:
https://sebit-mcp.com/mcp

returns HTTP 401 Unauthorized.
Authenticated MCP connections work correctly.
The server supports:
Streamable HTTP
Bearer personal access tokens
OAuth-capable MCP clients

The MCP server has already been connected and used successfully from external MCP clients.
Additional observation
The CLI considers the plugin already published.
Attempting to publish it again returns:
Plugin "cajas-mcp" is already published; use lhm plugin update for version "0.1.1"

However, the public Marketplace API lookup for the identifier currently returns 404:
GET https://market.lobehub.com/api/v1/plugins/cajas-mcp

So the current state appears to be:
Published: yes
Claimed: yes
Version update: successful
Validation: not_validated
Public plugin API: 404
Validation error/reason: not exposed

Expected behavior
One of the following would be expected:

The MCP listing becomes validated if the configuration is valid.

If validation fails, the CLI or Marketplace API exposes the validation failure reason.

For example:
Authentication challenge not supported
Endpoint healthcheck failed
Unsupported manifest field
Transport validation failed
License validation failed
OAuth discovery failed

Actual behavior
The only diagnostic available is:
status: not_validated

There is no indication of which validation step failed or whether validation was executed at all.
Questions
Could you please check the validation job/state for listing ID 89390 / identifier cajas-mcp?
In particular:

Was a validation job actually executed for version 0.1.1?
If it failed, what validation check failed?
Does the Marketplace validator support authenticated Streamable HTTP MCP endpoints that return 401 before credentials are supplied?
Is auth.type: "bearer" the correct manifest declaration for this type of remote MCP server?
Is the 404 from /api/v1/plugins/cajas-mcp expected while a listing is not_validated?

It would also be very helpful if market-cli exposed the validation error or status reason instead of only returning not_validated.

[sebit-provider]

Additional diagnostic results:

I manually tested the MCP handshake without authentication.

1. POST initialize
   → HTTP 200 OK
   → protocolVersion: 2025-06-18
   → mcp-session-id returned

2. POST notifications/initialized
   → HTTP 202 Accepted

3. POST tools/list using the returned mcp-session-id
   → HTTP 200 OK
   → tool definitions returned successfully

So the server supports a complete unauthenticated MCP initialization and tool discovery flow over Streamable HTTP.

A bare GET /mcp returns 406 because it lacks Accept: text/event-stream, and GET with that Accept header but without an MCP session returns 400 Missing session ID. However, the normal MCP POST initialization flow succeeds completely.

This suggests the listing's not_validated status may not be caused by basic MCP connectivity or protocol compatibility.