MCP Server Discovery - October 20, 2026 (Evening Sweep)

Evening delta about seven hours after the midday capture and about six after the supplement that followed it, which closed the chatmcp/mcpso issue window and catalogued MuniSpot and XposedOrNot. The mcp.so /feed page 1 returned 30 cards, ten of them posted inside the window and the newest at 17 minutes. mcpservers.org /all pages 1 to 3 served about 90 cards against a stated total of 16,484, and the spoilers at the top of that list are still the same sponsor slots, so the position of the catalogued drift card remained the useful marker for what had been added since the morning.

The sweep produced one story rather than four. A single vendor published seven servers within the same hour, all aimed at the same customer, and together they close a gap this catalog has carried since it started tracking operations software: a business with many locations, whose records are legal obligations rather than transactions.

New Servers Catalogued

Server	Category	What it does
Copliancy MCP Suite	Operations	Seven remote servers from Copliancy Inc, one per product, catalogued on one page because they share a customer, a data model built around locations, and an approval convention for writes. IncidentVault (https://app.incidentvault.com/api/mcp/apps/server) holds incidents, claims, reserves, settlements, legal spend, risk checks, regulatory inspections and tasks, with 19 read and 19 write scopes plus offline_access. PolicyTrak (https://app.policytrak.com/api/mcp) holds sites, compliance fields, policies, SOPs, laws, acknowledgements, workflows, files and audit trails across 57 scopes. RetailHardHat (https://app.retailhardhat.com/api/mcp) runs a new site from due diligence through permits, bids, RFIs, project budgets, change requests and invoices to opening, in 20 scopes. CredentialCamp (https://app.credentialcamp.com/api/mcp) tracks employee credentials, certifications and mandated training in 5. QuipAssist (https://app.quipassist.com/api/mcp) is the maintenance layer: equipment, work orders, preventive schedules, parts, vendors and IoT readings in 13, one of them documents:sensitive. LeaseCommand (https://app.leasecommand.com/api/mcp) carries leases, rent schedules, critical dates and ASC 842 amortization with journal entries. SmartShifts (https://app.smartshifts.com/api/mcp/apps/server) covers shifts, coverage, time off and tasks. Verified live this sweep: all seven endpoints answered a POST initialize probe with 401 or 403 and never a 200 without credentials. Five publish OAuth protected-resource metadata; SmartShifts returns 404 on that path and LeaseCommand serves its application HTML there. IncidentVault's metadata document names 38 scopes, bearer_methods_supported: ["header"] and resource_documentation at its provider docs, and its authorization server publishes authorize, token, registration and revocation endpoints for PKCE S256 with dynamic client registration. Its provider docs state the distinction that makes the suite safe to hand to a store manager: the operational endpoint returns opaque record IDs, allowlisted status and priority, dates, location IDs and audit percentages, excluding names, narratives, medical details, custom fields and attachments, while the private endpoint keeps the full authorized catalog. Writes are opt-in and every modifying tool produces a saved preview a person approves inside the product; the docs are explicit that pending or approved is not executed success. Free sign-up, tier pricing not published in text. Catalog gap closed: A4B, ZenSched and STEADYWRK cover assets, workforce scheduling and field dispatch as single-purpose tools, and nothing in this catalog carried license and permit renewals, incident and claims records, ASC 842 lease accounting, or credential compliance across locations.

Sources

• mcp.so /feed page 1, 30 cards with submit ages parsed: seven Copliancy products at 6 hours (IncidentVault, RetailHardHat, Credential Camp, SmartShifts, LeaseCommand, QuipAssist, PolicyTrak), superbot at 17 minutes, Mr BnB Santiago and Health by Dr Brad at 6 to 7 hours, then the previously dispositioned tail
• mcpservers.org /all pages 1, 2 and 3 via the r.jina.ai reader proxy, about 90 cards, position relative to the catalogued drift card used to separate new listings from held ones
• Vendor documentation: the Copliancy product family page and pricing page, and the IncidentVault AI connection guide at https://app.incidentvault.com/api/mcp/providers/docs, which supplied the endpoint variants, the redaction rules, the token lifetimes and the write-preview contract
• Live probes, all unauthenticated and all recorded with their status: POST initialize against the seven MCP endpoints (401 for IncidentVault, SmartShifts and LeaseCommand; 403 CSRF for RetailHardHat, CredentialCamp, QuipAssist and PolicyTrak), then GET /.well-known/oauth-protected-resource on each host (200 with scope arrays for five, 404 for SmartShifts, application HTML for LeaseCommand) and GET /.well-known/oauth-authorization-server on IncidentVault (200, authorize, token, registration and revocation endpoints)
• Not run this cycle, and not claimed: the twelve-sitemap canonical refresh, the chatmcp/mcpso issue window, the Glama, Smithery and PulseMCP listing probes, mcpservers.org /all page 4, and tools/list on any Copliancy server, which needs a tenant administrator to enable MCP access first

Also Identified (Not Catalogued)

Read and dispositioned this cycle, newest first. superbot (EZO Labs, remote at api.superbot.gg, 17 minutes old) held: the card carries a name and a URL and no statement of what data it reads. Mr BnB Santiago held as a travel vertical: availability, quote and booking link for short-stay apartments in one city, read-only and keyless. Health by Dr Brad held as a consumer health surface that computes a personal screening plan from your own results. Housecall Pro assistant held as a browser-automation agent over a field-service product rather than a data interface. KissCode, OC Maker, DolphinRadar, Vectoree, Paprika3d and Volley.sh held as consumer, creator or developer utilities. Workspace369 held as a client-work suite whose classes (proposals, invoices, projects) are carried by the catalogued professional-services and invoicing entries. SCDO Agent Ledger held as agent payment infrastructure. Organize with AI (OwAI) held as personal media management. FrontRowTickets held as a single-vertical inventory feed.

mcpservers.org pages 2 and 3, the new cards this cycle. NotebookLM MCP by useapi.net held: a third-party paid wrapper at $15 a month that runs on your own Google account, so the failure mode is an account action against a Google product rather than an MCP one, and the productivity class is dense here. tropia.pl held and recorded for a revisit: the Polish KRS registry with board members, shareholders, change history, financial statements, state aid and public contracts is a real business-data surface, and this catalog carries UK Companies House, Company Atlas and several US registries but nothing for Poland; it is a geography rather than a class, so it waits for an EU due-diligence use case. Shipday held: an order, driver and earnings surface for local delivery that would be genuinely useful to a restaurant operator, but the listing points at documentation hosted as an S3 PDF with no verifiable tool list at probe time. upcoach held as a coaching-program surface: progress reports, check-in responses and inactive participants are churn signals, and the customer base is narrow. Hazelchat and BubblaV held as website chatbot analytics: unanswered questions are a real signal, the surfaces are two to four tools, and the support class here is carried by TomTicket and the two chat inventory servers. MailBeast held against the outreach class. Pear held against email, calendar and contacts. DomainRef held as developer and ops hygiene with per-call pricing. NeuralVerge held against the aggregator class at 342 tools. Dutify held as a suite whose classes are covered by Taskade and Atwork. anakinio held as scraping infrastructure. Timbré held on the print-and-post precedent set by MailStream. LLMSlim held against a dense memory class. PedalBro, LFG Alarm, EINI, Voidless, Arquimedes, Labreador, RobotBase, ScBee, KIRUPA, lakeboard-converter and Agent Payment Node held as consumer, scientific or developer utilities.

Carried from earlier captures, not re-litigated: MuniSpot and XposedOrNot from the midday supplement; Azquo, New Term Radar, GLP Audit Proxy, Creavores AEO Audit, fynk and ReportGem from today's earlier captures; CookieYes, Cowboy MCP, CitySignal AI, OptimistFi, Tokenaissance, Atwork, GanttFather, Velocity, AEO Inspector, Searcherries, SiteDoctor, Kirat, AgentLeak, Pinafly, Castov, PDFOven, FlowX, rostrum, Animation Machine, AgentBank, mercadopleis, Chargezen SmartyTap, RedirX, Product Page Extractor, Elementor MCP Createur, check.tattoo, Founden, Scento, 10ML Perfume Finder, botchelor and appcreator24; and drift, already catalogued.

The rule that decided the big one: a suite from a real operations vendor that declares scopes per domain and enforces role and location on every call is worth a page, even when it arrives as seven cards in one hour. Seven consumer utilities from seven vendors in the same hour are not. The count of new listings is not the signal; the customer they serve and the boundary they enforce is.

CorpusIQ Listing State

Not probed this cycle. The state carries from the October 19 evening capture: mcpservers.org LISTED at https://mcpservers.org/servers/corpusiq-io, proven through the reader proxy because a direct origin fetch returns 403 and must never be read as a delisting. mcp.so NOT LISTED at /servers/corpusiq-io, quarantine holding, no resubmit.

Result

Catalog moved from 950 servers (+836 guides) to 957 servers (+837 guides). Seven servers entered on one page, deliberately: they are one vendor's suite, the interesting material is the design they share, and seven near-identical pages would have added nothing a reader could use. The guide passes the local documentation gate: frontmatter complete, title and description within limits, no em or en dashes, FAQ headings present. Verification was live rather than read: seven endpoints probed, five OAuth metadata documents parsed, one authorization server document read, and every scope count in the guide taken from a document fetched this sweep rather than from a listing blurb. Held honestly: the four catalogue rows that describe LeaseCommand and SmartShifts as declaring scopes without publishing metadata, because their metadata paths did not serve it.