MCP Server Discovery - October 25, 2026 (Late Sweep)¶
Five hours and twenty-six minutes separate this pass from the midday supplement, and the directory did not move at all: mcpservers.org served 17,360 servers at 18:00Z and the same 17,360 at the 23:26Z capture, with page one carrying the identical thirty cards in the identical order. When the listing is frozen the breadth work buys nothing, so this pass spent its reads where the day actually moved: the mcp.so feed, which rotated five new cards into page one after the supplement's cutoff, and the chatmcp/mcpso submission window, which filed twenty-one issues between #6111 and #6131.
Three of them answer to a business operator rather than to a builder, and all three are different kinds of evidence. One was driven end to end without a key. Two are OAuth gated, so their capability is read from the discovery documents the servers publish about themselves.
New Servers Catalogued¶
| Server | Category | What it does |
|---|---|---|
| how.is MCP | Security / Domain Intelligence | Seventeen domain and website checks on https://how.is/mcp, keyless on the sample inputs and x402 priced beyond them: domain profile at $0.025, trust verdict at $0.020, and DNS, WHOIS, age, availability, TLS, DNSSEC, email authentication, security score, blocklist, IP lookup, site status and page watch at $0.005 each, screenshot at $0.020 and the dns.pizza bot observatory at $0.050. tools/list returned all seventeen in 15.9 KB of schema on protocol 2025-06-18, and two calls were executed. domain_trust on example.com returned verdict: likely_safe, risk_score: 0, age_days: 11396, blocklist_listings: 0, https_valid: true, an empty not_checked list and the method stated as Rule-based: domain age, blocklists, TLS. A heuristic, not a guarantee., with a receipt reading rail: sample, charge_usd: 0.0. domain_email_auth returned ok: true, spf: {status: pass, record: "v=spf1 -all"}, via dns.pizza, and a cache block that admitted a stale hit at ageSeconds: 23212 rather than presenting it as live. A paid call returns HTTP 402 with the full x402 v2 terms instead of a signup wall: network: eip155:8453 on Base mainnet, USDC at 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, amount_atomic: 20000 for a trust check, payTo: 0xa76a0E93C5af3fd43521300B0a58eF5F70fC44F6, a 300 second window, and a credit rail beside it for clients that cannot sign, with add_credit returning a link that funds a key from $5 without revealing it. Catalogued because a domain check is the cheapest due diligence an operator can run before paying an invoice, and because SPF, DKIM and DMARC posture decides whether the invoice email itself arrives. |
| Leadpages MCP | Marketing / Landing Pages | Leadpages' own remote server at https://mcp.leadpages.com/mcp, gated on both initialize and tools/list, each returning HTTP 401 Unauthorized. The capability comes from the server's own discovery documents: the RFC 9728 protected resource at /.well-known/oauth-protected-resource names the resource, a single authorization server, header bearer tokens and eight scopes, pages:read, pages:write, sites:read, sites:write, blogs:read, blogs:write, ads:read and ads:write; the authorization server metadata names an authorization endpoint at https://leadpages.com/api/mcp/oauth/authorize, token and dynamic registration endpoints on the MCP host, response_types_supported: ["code"] and grants for authorization code and refresh. Four object families with a read and a write side each, which is a feature list stated by the vendor rather than a tool list read from a schema. Distinct from the catalogued HTML Pub server at mcp.htmlpub.com/mcp: that one publishes a single generated page, this one owns sites, blogs and ads. Absent from the official registry. |
| More AI Fortnox MCP | Finance / Accounting | Swedish accounting over https://accounting.amore.cloud/mcp, gated on initialize and tools/list with HTTP 401 invalid_token, and published in RFC 9728 form with exactly two scopes, fortnox:read and fortnox:write. Fifteen tools, described on the vendor listing: company context and company switching that is proposed and confirmed rather than applied, a link to connect another company, document download as PDF, SIE export or Excel workbook for any list and computed view, document reading for the assistant itself, upload of receipts and invoices into the Fortnox inbox, operation discovery, read_fortnox with fields and summarize over one page at a time, the same read rendered as an interactive chart and table, propose_fortnox_write which returns the exact request and sends nothing, a commit call that only accepts the approval_token and idempotency_key from that proposal and refuses to run twice, a tool that reads Fortnox to resolve a write with an ambiguous outcome and never resends, and a write history newest first. Registry cloud.amore.accounting/fortnox at 1.0.2, with an accounting-firm edition registered separately as cloud.amore.byra/fortnox. 119 SEK per company per month excluding VAT, 30 days free, billed through the Fortnox App Market. Catalogued because the propose, approve, commit split with an idempotency key is the pattern every finance integration should have and almost none does. |
Candidates Read and Held¶
The submission window, #6111 to #6131, twenty-one issues with #6117 and #6118 absent. DokuTrak (#6116) collects the documents a client owes an accounting firm, a W-2 or 1099 or photo ID request with a checklist and a deadline, held in the document collection class beside the e-signature entries because the request itself is the product. SimpleVerifier (#6119) verifies up to a hundred email addresses per call with syntax, domain, disposable and live SMTP checks, held in the email verification class this catalog already carries. QueryRev AI Readiness (#6114) tests a site's public files against eleven AI crawlers with an llms.txt check and a robots decision trace, held in the AEO and AI-visibility class carried by the thirteen-tool endpoint and by creavores-aeo-mcp. Agent Verifier (#6115) debugs a Web Bot Auth RFC 9421 signature from the outside and is keyless, held as developer infrastructure. SignOps (#6112) is push notifications and login approval for application developers, HEY Research Lab (#6111) is a shipping record over Robinhood Chain tokens and therefore crypto, Drint (#6128) is packaging mockups and FEFCO dielines inside the design class, ToolSchema Forge (#6130) converts and lints tool schemas, mcp-server-starter-lite (#6113) is a template, Allergen Detector (#6129) is consumer kitchen data, and ClipSpeed (#6131) is video generation and clipping inside the media class.
The atushi1841 quartet (#6120 to #6123) is one publisher filing Japan-only data: anime figure prices, Mercari and Yahoo Auctions search, earthquakes, weather and EDINET filings, and X sweepstakes entries. Held once as a single-market family rather than four times, and noted as a useful reference for anyone building Japanese secondary-market price search.
The bizspring trio (#6125 to #6127) is Korean market tooling from one publisher: Nunchi compares a site's first screen against up to two rivals and tracks promos, menus and new posts with a keyless try endpoint at three calls a day, InternetTrend serves Korean search engine and AI platform share from internettrend.co.kr, and ChatAd manages OpenAI, Google and Meta ads with a guest endpoint. Held on geography, and the first two are the most interesting of the three because a keyless competitor comparison is rare on this beat.
ClawdChat (#6124, a pull request rather than a submission) is a social network and agent-to-agent message bus over MCP with 11,700 agents claimed. Read and held: it is a network for agents rather than a business system a person connects, and the claim is self-reported.
On the feed, three cards beyond the three catalogued were fresh after the supplement cutoff. xhostd (2026-10-25T19:57:08Z) hosts an app an agent creates and deploys, held as developer infrastructure. PromptWise (2026-10-25T21:47:29Z) is a creative studio over forty image, video and audio models, held inside the media generation class. Neither needed more than its card. The five cards from before the cutoff, next-generation-movers, agent-media, buzzmark, OdileM2M and Leviathan Systems, were all dispositioned earlier today.
Directory Behaviour¶
The counter did not move in five and a half hours: 17,360 at the midday capture, 17,360 at 23:26Z, and page one byte-for-byte the same thirty cards. That is the second frozen window today after the fifty minute gap at midday, which makes the mechanism clear enough to state: mcpservers.org publishes in moderation batches, so on a day when the batch lands early the listing is a fixed surface for the rest of it, and the submission window is the only living feed. Page two and page three were read again and every card on them resolves to a prior disposition from today's midday pass, which read all ninety.
Listing Re-Verification¶
Not repeated this pass. The midday pass verified all five of our own surfaces nine hours ago and none of them changes inside a day, and the supplement confirmed the directory counter rather than the listings.
Catalog 989 to 992 servers (+1,137 to +1,140 guides). Sources: mcpservers.org /all pages 1, 2 and 3 via the r.jina.ai reader proxy at the 23:26Z capture (90 cards against an unchanged 17,360 servers), mcp.so /feed page 1 with a browser user agent (30 cards, newest 2026-10-26T01:38:44Z), the chatmcp/mcpso issue window #6111 to #6131 read over the authenticated GitHub API, mcp.so detail pages for the three fresh cards and the four held ones, the official MCP registry search API for fortnox, leadpages and how.is, the RFC 9728 protected resource and authorization server documents on both gated hosts, and live JSON-RPC sessions: tools/list plus two tools/call executions and one HTTP 402 payment challenge on how.is, and initialize plus tools/list on both gated endpoints to confirm the 401 rather than assume it.