MCP Server Discovery - October 19, 2026 (Evening Sweep)

Evening delta about eight and a half hours after the October 19 midday capture. Both directories rotated hard in that window: the mcp.so /feed page 1 produced six cards posted after the midday pull and none of them cleared the bar, while mcpservers.org /all pages 1-4 served 120 cards, 99 of them not named anywhere in the midday sweep or the night sweep before it. One entry was catalogued, and it is the first entry this catalog has added in the agent-governance class since August: a pre-action mandate gate whose job is to refuse a payment that has quietly left the authority it was granted.

The verification on this one produced a finding worth writing down. The hosted server is live and every one of its six rules was fired deliberately against it. Its own README, though, tells you to pip install drift, and the drift package on PyPI belongs to an unrelated CMS content editor that last published version 0.0.7 from a Bitbucket repository. Following the install instructions installs a different library. That is recorded in the guide rather than glossed over, because an install command that silently fetches the wrong package is exactly the kind of thing that gets blamed on the agent later.

New Servers Catalogued

Server	Category	What it does
drift MCP	Compliance / Agent Governance	Apache-2.0 MCP server (github.com/mrpkk/drift, default branch master, created October 4, 2026, last push October 20, 2026, zero stars and forks, Python 3.11+, dependencies = []) hosted at https://drift.rta.lat/mcp speaking Streamable HTTP, protocol 2025-06-18, server info drift 0.1.0, no auth. Three tools, all annotated read-only, idempotent and non-open-world: drift_check (one action against one mandate), drift_session (a list of actions, per-action verdicts plus a chain fingerprint) and drift_explain (the rules in order, with reasons). The gap it fills is precise: AP2 verifies a payment mandate once, at signature time, and after that nothing holds the agent inside it. drift re-checks six rules in a fixed order before every action - amount, payee, audience, currency, window, intent - default DENY, with the refusal naming the most important rule rather than an incidental one. The mandate is a frozen dataclass (an edit makes a new mandate, it cannot widen the signed one), window bounds are inclusive, amounts are integer minor units, and a session's fingerprint breaks if any earlier decision is rewritten or reordered. Verified live, one probe per rule: within-limit action ALLOW with fingerprint 67e0bbb428d77670; 99999 against a 10000 cap DENY amount; wrong payee DENY payee; audience swapped to attacker.example DENY audience; EUR against USD DENY currency; action past valid_until DENY window; wire_all against ["buy"] DENY intent; and a three-action batch returned {submitted: 3, allowed: 1, denied: 2, breach_by_rule: {"amount": 1, "payee": 1}}. One footgun found and documented: an empty allowed_intents disables the intent rule - a mandate with [] returned ALLOW for an intent named transfer_everything, which the spec treats as an explicit "any intent" decision. Stated limits, from the vendor: it does not verify signatures (AP2 does), does not execute, keeps no state, and intent arrives from the agent as untrusted input; proving what actually happened is the same author's attest. Pricing: hosted free tier 100 checks a day, above that x402 per call on Base; self-hosting free, optionally via the included Dockerfile or windmill_script.py. Install trap, verified: PyPI drift is an unrelated CMS package at 0.0.7 and drift-mcp does not exist (404), so pip install -e . from a clone is the working path.

Sources

• mcp.so /feed page 1 (29 server and client links, six posted after the 19:30 UTC midday capture: Organize with AI, botchelor, Volley.sh, Paprika3d, 10ML Perfume Finder and FrontRowTickets)
• mcpservers.org /all pages 1-4 via the r.jina.ai reader proxy with X-Return-Format: markdown (120 cards; a direct fetch of the origin still answers 403, so the proxy is the only working path; 99 of the 120 are not named in the midday or night sweep)
• Vendor documentation for the catalogued entry: README.md, SPEC.md, pyproject.toml and server.json from mrpkk/drift at master (the repository's default branch is master, so raw.githubusercontent.com/.../main/ returns 404)
• Live probes against https://drift.rta.lat/mcp: initialize (200, protocol 2025-06-18, server drift 0.1.0), tools/list (3 tools with full schemas and read-only annotations), and eight tools/call probes covering all six rules, the empty-allowlist case and a mixed batch
• Repository metadata via the GitHub API: created 2026-10-04, pushed 2026-10-20T00:43Z, 0 stars, 0 forks, 0 open issues, Apache-2.0, Python, 322 KB, topics include guardrails, mandates, x402, base-mainnet
• Package registry checks: PyPI drift returns the unrelated 0.0.7 CMS package (releases 0.0.1 through 0.0.7); PyPI drift-mcp returns 404
• Not run this cycle, and not claimed: the twelve-sitemap canonical refresh, the chatmcp/mcpso issue window, and the Glama and Smithery listing probes. They return on the next full-window sweep.

Also Identified (Not Catalogued)

mcp.so feed, fresh cards (6): Organize with AI (OwAI - search and manage photo and video libraries across local folders, Apple Photos and OneDrive: find image and video moments, review duplicates, organise collections, groups, favourites and people; the media-management class is a local utility and imagery is not a data source) held; botchelor (a blind-date show for fictional characters that AI agents play; entertainment novelty) held; Volley.sh (sequence diagrams written as plain text with the real request and response payloads on every arrow, syntax-checked by the server; a developer communication utility) held; Paprika3d (Three.js MCP server and Claude Code plugin that screenshots, plays, tests and profiles three.js, React Three Fiber and WebGL pages in headless Chrome on a paused seeded clock; dev and visual-testing utility) held; 10ML Perfume Finder (a free public fragrance index - notes pyramids, accords, families, similar scents; consumer novelty) held; FrontRowTickets (live ticket inventory for one resale marketplace: search, availability, pricing, deals; single-marketplace commerce data) held. The rest of page 1 carries its midday disposition - appcreator24, dreamwork, arvx, status-is-down, veltake-studio, Searcherries, caimera, NeuralVerge and golfdata - and behind them the night cohort of tropia.pl, PopNow, Thordata, HousingFeed, QRStuff and Cowboy MCP.

mcpservers.org /all pages 1-4 (120 cards, 99 not named in the midday or night sweep). The closest calls, all held and worth naming:

• attest (mrpkk/attest) - the same author's complement: four layers of checks on a foreign artifact before an agent trusts it (schema, emptiness, prompt-injection including base64-wrapped instructions, provenance), deny-by-default, 399 tests, free tier 20 checks a day then x402. Held rather than catalogued because the artifact-verification and prompt-injection control class is already carried by Poison Armor and zn-gate, and a second entry in the same class this cycle would be filler. It is the natural next entry if that class thins, and the guide for drift points at it.
• Brik - the official remote MCP server of Brik, French rental management software: properties, leases, rents and tenants, OAuth 2.1, read by default. Held: the property-management class already holds AskRent, Dutch Property Context, Hercules Property and LucidRents, and this adds a jurisdiction rather than a capability.
• Invokary Platform Requirements - read-only data on what Claude, ChatGPT, Cursor and the Official MCP Registry each require before they will list an MCP connector or plugin. Held as a catalog entry because it is a meta reference rather than a business data or operations surface, but it is genuinely useful to us directly: it is the submission-requirements checklist for a directory programme this repo already runs.
• Recoup and Winback HQ - both are remote read-only MCP servers whose tools describe their own product and run an exposure or revenue estimate (get_recoup_overview, get_recoup_pricing, estimate_refund_exposure, list_supported_sources; get_winback_overview, estimate_win_back_revenue, get_apple_retention_facts). Both state plainly that they read no customer data. Held: they are vendor marketing surfaces reached over MCP, not data sources. The underlying ideas are good ones and worth watching - Recoup audits what an AI support agent promised in Gorgias, Intercom Fin or Zendesk tickets against what Shopify and Stripe actually did, and Winback charges only on recovered subscription revenue - but what is exposed to an agent is a sales pitch, so there is nothing for a customer to connect.
• Glimind - live reliability, agent-readiness and safety data for every public MCP server: check whether a tool works before calling it, find a working alternative, audit your own server. Held: meta and developer-infrastructure class, adjacent to the directory and scanning entries already carried.
• ChromeWalk - a private standalone local browser (Chromium, Firefox, WebKit) driven through 35 MCP tools: fetch and render, screenshots, SEO and accessibility audits, cross-engine smoke checks. Held: the browser-automation class is dense and already carried.
• Synter Ads MCP - ad data across 43 platforms with write depth varying by API. Held: the ads-data class is saturated and CorpusIQ ships its own cross-source ads connector.
• Chargezen fleet (SmartyTap, Spark!, CheckoutOS, Concierge, developers-mcp) - email marketing flows, creator and affiliate programmes with partner links, codes and payouts, post-purchase checkout blocks, and autonomous chat, phone, SMS, WhatsApp and email support with approvals. Held: the fleet carries its October 18 disposition, and the affiliate-programme and support-automation classes are dense.
• SEO group - SiteDoctor (SEO, speed, security-header, SSL and broken-link audits, pay per call), FlexQueries (backlinks, rankings, site audits, pay as you go), SEO Perception (Search Console, crawl and SEO to-dos, read-only), AEO Inspector (AEO grader plus a 10-engine AI-visibility report), Firemark (AI-answer visibility). Held as a group: the SEO-data class is saturated and our own SEO feed is DataForSEO, while the AI-visibility class is already carried per geolint, LogNorm, Cite42 and AIGROW.
• Outbound and social group - MailBeast (cold email campaigns with A/B sequences, warmed mailboxes, reply handling), Gojiberry AI (high-intent B2B leads from buying signals with enrichment and LinkedIn plus email campaigns), ShortSync (schedule short-form video to TikTok, YouTube Shorts, Instagram, X and LinkedIn with analytics), Hypello (Instagram comment and DM automation), SocialDataX (sensitive-word checking). Held: outreach, social-publishing and moderation classes are dense, and our publishing path is Postiz.
• Task, doc and dev utilities - GanttFather (Gantt charts, 27 tools), Dutify (call recordings, project management, wiki, feature requests), Rylvo (agent workspaces), FramerToNextJS (edit and publish converted Framer sites), Porch (public URLs for webhooks and OAuth redirects), Layerdock (website feedback with CSS selector, screenshot and console trace), Shotkiln (screenshots, PDF and OG images), Castov (ports and processes, CIDR, ID timestamp decoding), AgentLeak (privacy scanning of traces and logs), fraise (in-memory knowledge store), ActAs and Agent Payment Node and Sato Hub and OpenAgentForum (agent identity, local payment tools, onchain tooling index, Ed25519-signed agent messaging), CaptchaNo and anakinio (captcha solving, web data infrastructure), APIbase, ToolGrade, Glimind's neighbours, lakshmanturlapati/fsb, InkRoom, 12axestest, lakeboard-converter, People Remover, Reader Assist, TPSClear, ConnectMachine, keyshortcuts, rendlet, BodyPal, Tokyo Futuro, Mestre Pratico, Window Well Covers, Understand This Video, Podwise, Whale Coupons, Product Page Extractor, STEADYWRK, mercadopleis, Synmerco, OptimiztFi's neighbour OptimistFi, PDFOven, AgentBank, Founden, rostrum, Animation Machine, FlowX, check.tattoo, RedirX, Jobven, WellFred, Chinaready, NobetciEczane, Google Flow, NotebookLM and Meta Muse via useapi.net, KIRUPA, WebMCP Demo Store, Cuevr, HIVE's messaging neighbours, and the rapidapi wrapper shells as a class-grouped remainder. Each was read and grouped by class; none closed a gap.

One pattern worth recording for next time: four of the last six mcpservers.org cards in this capture follow the same shape - a remote MCP server whose only tools describe the vendor's own product and run its calculator. Recoup, Winback HQ and two others in the page-2 cohort are built this way deliberately, because a listing on an MCP directory is now an acquisition channel. It is a legitimate use of the protocol and a poor reason to catalogue something, so the disposition rule is: if the tool reads no customer data and answers only questions about itself, it is a sales surface and it is held.

CorpusIQ Listing State

Checked this cycle:

• mcpservers.org: LISTED - https://mcpservers.org/servers/corpusiq-io serves the CorpusIQ page (title "CorpusIQ MCP Server"). A direct fetch of the origin returns 403; the proof is the reader-proxy response, so a 403 here must never be read as a delisting.
• mcp.so: NOT LISTED - /servers/corpusiq-io returns 404. Quarantine holds, no resubmit.

Glama and Smithery were not probed this cycle and carry their October 18 state.

Result

Catalog moved from 941 servers (+827 guides) to 942 servers (+828 guides). One guide written, live-probed at the endpoint that could be probed: initialize, tools/list and eight tools/call probes across all six enforcement rules, the empty-allowlist case and a mixed batch, plus repository, pyproject.toml and PyPI metadata checks that surfaced the install-name collision. Held honestly: the sitemap refresh, the issue window and the Glama and Smithery probes did not run.