MCP Server Discovery - October 23, 2026 (Night Sweep)

A seven-hour overnight delta after the October 22 evening capture, and the finding worth recording is not a server but a disagreement inside the record: the directory card said the server takes no authentication, and the endpoint answered 401 invalid_token on the first probe.

The feed produced two cards inside the window. mcpservers.org /all pages 1 to 3 returned 89 unique slugs against the evening pass's 90 and supplied nothing the ledger had not already dispositioned. The submission window, #5974 through #5983, ran ten issues in seven hours and every one landed in a class this catalog already carries. One entry cleared the bar, and it is the first cross-marketplace research surface here rather than a twelfth Amazon reader.

New Servers Catalogued

Server	Category	What it does
Nexscope MCP	Commerce & E-Commerce	Twelve storefronts behind one endpoint: Amazon, TikTok Shop, Walmart, Temu, Ozon and Wildberries, 1688, Shopee, Etsy, eBay, Mercado Libre, Shopify and Google, with a 91-tool Amazon block (55 of them Amazon Ads and Sponsored Products campaign, keyword and budget management) and 61 TikTok Shop research tools. https://api.nexscope.ai/mcp, OAuth 2.1 authorization code with PKCE S256 on scope mcp:tools; the REST face takes Authorization: Bearer nk-... API keys. Probed live: unauthenticated POST initialize returned HTTP 401 {"error":"invalid_token","error_description":"Authentication is required."} with www-authenticate: Bearer resource_metadata="https://api.nexscope.ai/.well-known/oauth-protected-resource/api/skill-api/v2/mcp"; that advertised path returns HTTP 200 carrying a Kong error body ({"code":99404,"msg":"No static resource .well-known/oauth-protected-resource..."}) instead of a protected-resource document, while https://api.nexscope.ai/.well-known/oauth-authorization-server returns a complete authorization-server document (authorize, token, JWKS, revoke and introspect endpoints, authorization_code and refresh_token grants, S256, client_id_metadata_document_supported: true, and the single scope mcp:tools). Tools: 235 pages in the vendor's public data directory, each with its own parameters, response reference and per-call credit cost, and each carrying an API & MCP tab; MCP names follow nexscope_<platform>_<action> (nexscope_amazon_search confirmed on the Amazon Search page). Per-call costs are published per tool rather than per plan: Amazon Search 21 credits base with a recent average of 30 and a 16 to 32 range, TikTok Shop product reviews 38, TikTok product discovery 15, TikTok batch product detail 10, Walmart product detail 29 base and 41 recent average, Shopify product query 25 base with a 10 to 188 range, Ozon keyword back search 17 base and 47 recent. Plans: free 1,000 credits for 3 days with no card and 1 MCP request a second; Starter $29 a month ($14.50 at 50% off the first month, $348 annual) with 30,000 credits and 3 MCP requests a second; Growth $55 ($660 annual) with 75,000 and 5 a second; Pro $129 ($1,548 annual) with 150,000 and 10 a second. Credits reset each cycle and do not roll over, annual plans are billed up front with monthly resets, and data-only top-up credits cannot be spent on creative generation. Gap named rather than claimed: no tool call was made, because every tool needs an OAuth connection to an account holding credits and this sweep does not create accounts, so the entry rests on the live 401, the authorization-server metadata, the 235 documented tool pages and the vendor's pricing table. And the record correction: mcp.so lists Authentication: None for this server, which the 401 contradicts; the entry states the authentication itself rather than repeating the card.

Candidates Read and Held

From the feed, the two cards posted after the evening capture closed at 2026-10-23T01:58Z:

• Cliptude (createdAt 2026-10-23T05:41Z, Media & Design, listed as local stdio with a remote endpoint at https://mcp.cliptude.com/mcp): turns a topic or script into a 6 to 60 minute faceless YouTube documentary with voiceover, sourced footage and animated maps and charts. Probed live: POST initialize returned HTTP 401 {"error": "invalid_token", "error_description": "Authentication required"}, OAuth or a Bearer key from /developers/. Held as media production rather than an operator data surface, the class carried by the catalogued clipkit, InstantClips, Transclipper and YouTube Kit entries. Its long-form documentary shape is a real product distinction and not a data class: nothing in it answers a business question the operator's own systems cannot.
• Nexscope (createdAt 2026-10-23T09:27:21Z) catalogued above.

From the submission window #5974 through #5983, ten issues in about four and a half hours:

• FormVault (#5981, https://api.formvault.eu/mcp plus an npm stdio package, io.github.terjetyl/formvault): list, get, create and delete forms and read submissions, with respondent data behind a separate tool the model is instructed not to call unless asked, AES-256-GCM at rest on servers in Nuremberg and a signed DPA on every plan. Probed live: POST initialize returned HTTP 401 {"error":"Missing bearer token"}. Held as website and form infrastructure, the class already carried by easydocforms, formdall, formlm, formstep, furrow-forms and philforms, and by BootForm in the October 22 midday supplement. The EU-hosting and consent-design angle is the strongest argument it has and is recorded here for reconsideration if that class thins; it is not enough to open a seventh entry in it.
• Keyword Research API (#5978, an Apify-hosted actor at mcp.apify.com): Google search volume, 12-month history, CPC, competition, keyword difficulty, intent for up to 10,000 keywords, keyword ideas, and the keywords a site ranks for, in every Google Ads country. Held against the SEO class saturated by DrUrls, HarborRank, MisarSEO, SEO Draft, SEOmely, SEOVally and SERP Sidekick, and against our own first-party Search Console and keyword work. An Apify actor with a token is a thinner surface than the entries already here.
• Building Permits API (#5979, Apify): official planning and building-permit records for France (SDES Sitadel, with the applicant company and its SIREN), New South Wales and Far North New Zealand, in one schema with source links. Held as regional vertical research data on construction activity, which is a property and development signal rather than an operator's own business record.
• ce-net (#5976, keyless read tools at https://ce-net.com/mcp): quotes and orders from a network of print farms and factories for 3D prints, CNC, sheet metal and PCBA, plus factory digital twins and compute offload. Held in the sourcing class carried by the catalogued Next Everything BOM pricing, and filed as a manufacturing marketplace rather than a data surface.
• Car Rental Brain (#5983, keyless at https://app.carrentalbrain.com/mcp, com.carrentalbrain/car-rental-brain): measured car-hire costs at 120+ airports in Europe, the UK and the US, including second-driver fees, deposits, debit-card acceptance, desk hours, out-of-hours fees and the desk's excess cover against buying in advance, from repeated dated searches. Held as travel vertical data: the measurement discipline is genuinely good and the surface is a consumer booking decision, not a business system of record.
• token-verdict-mcp (#5974, local stdio, $0.02 USDC per call on Base over x402): a token risk verdict, 0 to 100 score and six weighted market-structure signals. Held in the crypto screening class.
• mcp-ssh-exec-cmd (#5982, stdio, from GitHub): SSH host credentials encrypted at rest plus remote command execution with a connection-pool monitor and a companion CLI. Skipped on shape: a general remote-command surface offered to an agent is the one class this catalog does not hold by default, and the catalogued infrastructure entries are credential brokers and read-only diagnostics rather than executors.
• Bitlands (#5977, keyless at https://api.bitlands.lol/mcp, four read-only tools): a catalogue of indie products, apps and agents where every listing is a building, with products_search, product_get, product_integration and capabilities_list. Held as an agent-facing product directory, the class carried by SitePatent and the agent-social entries.
• SERVIQO Agents / DistributionOS (#5975): register an agent in one call, receive a founding number and tracked share links to a religious publication, with reach stats split into human and bot tiers. Held as an agent referral network, which is distribution plumbing rather than a data surface.
• WRDO (#5980, keyless at https://api.wrdo.co.za/mcp): local businesses, menus and price lists in Cape Town and the Western Cape. Carried its October 22 night disposition as a regional directory; re-read only because it arrived again as a fresh submission.

On mcpservers.org /all pages 1 to 3, 89 unique slugs against 90 at the evening capture and every one a prior disposition. The one-slug net drop is pagination and featured-slot spillover, not a listing removed. Three slugs surfaced by the capture resolved to 404 detail pages through the reader proxy: agentsearchhq-coder on page 2, and scdolab and justusewaldo on page 3, the same sitemap-fresh-but-not-live class the evening pass recorded five of. One held card was read properly rather than re-litigated: novai-prices (keyless hosted endpoint at https://aiapi-pro.com/api/mcp, tools cheapest_models, model_price, list_categories, normalising per-token, per-second and per-image prices across Chinese models) held as developer cost routing for AI subscriptions, the class carried by PlanLimits.

Source Behaviour Worth Recording

Two things about the surfaces are worth more than the count.

The feed's overnight rate is two cards in seven hours, against six in the ten hours the evening capture covered. Neither card was a repeat of an unseen earlier one, which reverses the failure the October 22 night sweep recorded: at that gap, eight cards had been fetched by an earlier pass and never dispositioned. Reading the feed twice at a short gap and diffing entry by entry is still the only reliable way to catch that, and this cycle's diff was clean.

A directory card is a claim and the endpoint is the test. mcp.so carried Nexscope as verified and featured with Authentication: None, and the endpoint requires a bearer token. The same cycle produced the mirror case: Nexscope's own www-authenticate header points at a protected-resource document that does not exist, while the authorization-server document one path over is complete. A client that trusts the card fails to authenticate; a client that trusts the header fails to discover. Both failures are silent in the tooling, so the only defence is the probe and the two metadata fetches, and the catalog entry has to state the authentication rather than inherit it.

Method

Sources: mcp.so /feed page 1 read from the TanStack payload with a browser user agent (27 server cards, newest createdAt 2026-10-23T09:27:21Z, oldest 2026-10-21T14:27:50Z), mcpservers.org /all pages 1 to 3 newest-first through the r.jina.ai reader proxy (89 unique slugs, cross-referenced slug by slug against the index headings, every guide directory and both prior captures), the chatmcp/mcpso issue window #5974 through #5983 read over the REST API with full bodies, mcp.so detail pages for two feed cards, and live JSON-RPC probes against four endpoints (api.nexscope.ai/mcp, mcp.cliptude.com/mcp, api.formvault.eu/mcp and the OAuth metadata paths on the Nexscope host). Nexscope was settled by the 401 and its www-authenticate header, the broken protected-resource path, the complete authorization-server document, 235 tool pages in the public data directory with their per-call credit costs, the pricing page's plan and limit table, and the vendor's GitHub repository nexscope-ai/nexscope-ecommerce-api (17 stars, last push 2026-10-20T09:49:26Z).

Catalog 977 to 978 servers (+857 to +858 guides).