MCP Server Discovery - November 1, 2026 (Midday Sweep)

This pass fired at 10:00 MST, seven hours after the early morning read. The two directory surfaces behaved in opposite ways, and one of them taught the pass something about how to read it.

The mcp.so homepage recentServers block carried 30 cards with a date and the newest at 2026-11-01T13:11:50Z, so exactly three sat above the 03:23:34Z stamp the morning pass closed on: maprouter-12eecf, knowra and socialfaktory-b87655.

The mcpservers.org /all newest page was read twice and the two reads disagreed. The first returned the counter at 18,726, the same figure the early morning pass recorded, with the same thirty slugs, and every one of those slugs sat inside a prior disposition, which is what a quiet page looks like. A cache-busted second fetch returned 18,732 with six slugs turned over. Since the page is ordered newest first and the counter moved by exactly six, the first read was a stale proxy snapshot and the second was the live page. The pass now treats a reader-proxy /all read that repeats the previous counter byte for byte as unverified until a cache-busted fetch agrees with it.

Three of the six turned-over slugs were new to the tree and three resolved to prior dispositions. The submission window #6540 to #6550 carried eleven more, every one read with its body rather than triaged from a title.

New: the fleet is the unit of work

Royally MCP is remote Streamable HTTP at https://app.royally.io/mcp, carried in the official registry as io.royally/royally at version 0.0.898 with status active and statusChangedAt on 2026-11-01T04:1xZ. A keyless initialize answered HTTP 401 with {"error":"missing_bearer_token"}, so the surface is live and gated rather than absent.

Two URL shapes are worth recording because both read like a delisting and neither is one. royally.io/mcp returns 404, the endpoint is on the app. host; and app.royally.io/.well-known/oauth-protected-resource returns 404 with no protected-resource document, so the auth shape is established by the 401 body and the vendor documentation rather than by discovery metadata.

The architecture is a cloud command layer plus a plugin on every site. An agent holds one connection instead of twenty site endpoints, and the plugin is what lets Royally read a site and make a change it can reverse. The change flow is the entry. A request is recorded with who asked and which sites it touches, held inside an approval window that can expire, optionally behind two-person approval and per-site-group rules, applied, and returned as a receipt naming who asked, who approved, what changed on which site and the one click that puts it back. The receipts collect into a fleet-wide log described as tamper-evident, so an edit to the record itself shows, and the log exports on a signed path. Safe jobs such as a page cache purge after a menu edit run without the queue, on the same reasoning that keeps a rollback fast.

Around that queue the fleet jobs run through the plugins the sites already have: updates with a backup taken first and automatic rollback, vulnerability and administrator-change alerts through GuardPress, Wordfence or Kadence, backup health through SiteVault or UpdraftPlus, uptime every five minutes with certificate, domain, page-speed and PHP fatal error checks routed to email, Slack, Discord or a signed webhook, bulk SEO titles and descriptions and menu items and custom CSS and template copies, WooCommerce prices and stock and orders with a seven-day undo, Elementor builds that wait for approval with a preview link first, SEO audits pulling Search Console and Analytics data through Rank Math and SEOSbolt, and weekly or monthly client reports in the agency's own brand beside a read-only client portal.

Pricing read directly: Solo $89 a year for 3 sites and 2 seats, Freelancer $249 for 5 sites and 3 seats, Studio $390 for 25 sites and 5 seats, each including the site plugin, the approvals, the receipts, the undo and the fleet jobs. An Agency tier adds white-label and developer extras at a price this pass did not read.

Why it earns a guide. Every WordPress entry in this catalogue is single-site. The official Automattic server works on WordPress.com hosted sites and the SSO connector handles identity on one installation; neither carries an approval queue, applies one change across a fleet or leaves a receipt per change. Royally is also the first entry here that governs other MCP servers rather than only its own tools: its documentation covers connecting the WordPress MCP Adapter, Easy MCP AI and the Elementor MCP behind the same connection under the stated rule that only Royally makes the change. That is supervision rather than a plugin list, and it is the same argument the tool-call audit entries have been making from the other direction.

Gap recorded. The endpoint is gated, so the tool count and tool names are the vendor's publication and not a measured list, and no tools/list was driven. The site plugin, the backup-first update path, the automatic rollback, the seven-day WooCommerce undo and the tamper-evident log are vendor claims this pass could not execute against a live site. The homepage states plainly that its example sites and receipts are invented, so nothing on that page is evidence. The registry record sits at 0.0.898, which reads as a pre-1.0 surface that moves often.

Read and held

Held on the promotion test, not on quality. Unthinkable (#6549) is a scored feed of 3,000+ business opportunities mined from public posts where people describe problems they want solved, each carrying monthly search demand and growth, the competitors already making money and a startup-cost estimate. The endpoint is https://app.unthinkableapp.com/mcp, 401 on a keyless initialize, OAuth 2.1 with dynamic client registration and PKCE, three published tools (search_ideas, get_idea, list_saved) and a hard gate on an Unthinkable Premium subscription. The catalogue holds no demand-signal opportunity entry, so the class is open; what is missing is a measured call rather than a documentation read, and it earns a file the moment a real market question returns a real scored answer.

Held on class. Fichário (#6550) is free, keyless and answering 200 with serverInfo fichario, turning 28.4M active Brazilian companies from Receita Federal open CNPJ data into two lookup tools, and it is held on the regional company-data rule already recorded against apipj for the same CNPJ dataset beside the OpenBase, Corporary and Fuentio holds. MCP Ads (#6546) is the pass's most relevant item on paper, an OAuth surface over Google Ads, Meta Ads, TikTok, LinkedIn, Microsoft Ads, GA4, Search Console and Tag Manager with approval-gated budget and bid changes at $49 a month, and its endpoint https://mcp-ads.com/mcp-slim answers 401 with {"detail":"Not authenticated. Provide a valid Bearer JWT."}; it is already carried here as the mcp-ads heading, so the pass records the stub rather than re-filing it. FynePDF (#6548) is PDF compress, merge, OCR, redact and sign in the document extraction and rendering class carried by Bannerify and url-to-pdf. Rast Creator Tools (#6547) is read-only short-form video safe zones, bitrate maths and SRT validation, a creator utility rather than an operator data source. Plane Workflow MCP (#6545) is the project-management class. LurkAPI (#6544) is 89 endpoint tools over social platforms and ad libraries, in the scraping and social-surface class. aliasflare (#6543) is self-hosted email aliases on Cloudflare Workers, agent-email and infrastructure. ATAbooking (#6542) is consumer travel booking beside The Charter Desk. neonloops (#6541) is agentic workflow orchestration with human approval, the dense orchestration class. AdminKit (#6540) is network, DNS, SPF, DMARC, TLS and header checks, and the domain and email-authentication class here already carries eurodns, dodomain, domain and just-domain beside a measured SPF and DMARC responder.

On the mcp.so block, Knowra searches arXiv by topic and exact announcement date and sits in the research class this catalogue already answers several times over; SocialFaktory writes, schedules and publishes to seven platforms and is held against the six catalogued social schedulers; MapRouter is a developer map utility with no operator data surface in its card. On the /all page, docspring-mcp is PDF form filling in the same document class as DocuQueue, pocketsmith-read-only-mcp is personal budgeting, kosa8ai/kosa8-claude-plugin is the kosa8 plugin catalogued on October 31 as kosa8-mcp, seatlayer-mcp is the SeatLayer surface catalogued in the morning pass, and werify-mcp is a prior hold on the read-only messaging archive slice.

Counts

The guide tree held 1,079 server entries before this pass and holds 1,080 after it, across 1,230 files under the guide tree, of which 1,228 existed before the new guide directory was written. Sources: the mcp.so homepage recentServers block read directly (30 cards with a date, newest 2026-11-01T13:11:50Z), mcpservers.org /all through the r.jina.ai reader proxy in X-Return-Format: html mode read twice with a cache buster on the second read (30 slugs, counter 18,726 stale then 18,732 fresh), the chatmcp/mcpso issue window #6540 to #6550 read with bodies in one authenticated call, the official MCP registry v0 API for royally, and a keyless JSON-RPC initialize against the Royally endpoint.

Tracking surfaces re-probed

The five CorpusIQ listings were re-probed in this pass. mcpservers.org serves /servers/corpusiq-io with the CorpusIQ title, 200. Smithery returns the Cprusiq publisher listing with displayName CorpusIQ. Glama serves io.corpusiq/multi-source-mcp on the /mcp/connectors/ route, 200. The official MCP registry carries io.corpusiq/multi-source-mcp with status active and the https://mcp2.corpusiq.io/mcp remote, and its description still reads 30+ business systems against a catalogue that now states 40+, which is a metadata drift worth correcting at the next publish. mcp.so answers 404 on all four direct slugs and remains not listed, with the paid route declined under the no-payment rule.