MCP Server Discovery - October 25, 2026 (Night Sweep)¶
The counter moved. After a full day of reading 17,243 servers at every capture, mcpservers.org served 17,354 at the 04:01Z read on October 25, an addition of 111 inside roughly twelve hours. A directory that grows by a hundred in a night is a directory whose first pages have been rewritten, so this pass read wide and shallow: /all pages one to six, and then judged what it found against the catalog, every sweep report and the last-sweep ledger before probing anything.
Three entries clear the bar. Twelve of the seventy names that appeared in no prior record were worth a live probe; three survived it.
New Servers Catalogued¶
| Server | Category | What it does |
|---|---|---|
| QodFlow MCP | Productivity / Operations | A kanban board with an SLA clock, exposed as nineteen tools: claim_job takes a lease so two agents cannot work the same item, request_human_decision opens a two-to-six option question and the agent waits, attach_evidence puts the artefact on the job rather than in a chat log, and get_timeline reads back who did what. Installed from npm qodflow-mcp 0.1.3 in this sweep and started; the binary exits with QODFLOW_API_TOKEN env var is required, so initialize and tools/list were not reachable without a workspace, so the tool names come from the shipped bundle, which routes to /v1/jobs, /v1/stages, /v1/members, /v1/tags and /v1/decisions on QODFLOW_API_BASE ?? "https://www.qodflow.com". The API was probed live and returned HTTP 401 UNAUTHORIZED with the vendor's own instruction to create scoped tokens at Settings → API Keys. Scopes are per tool (jobs:read, jobs:write, mcp:claim, mcp:assign, mcp:decide, mcp:evidence), test-mode tokens carry a qf_test_ prefix, and destructive verbs are not in the MCP surface at all because they live behind a typed confirmation in the interface. Registry com.qodflow/qodflow-mcp 0.1.3. Free tier $0, paid at $19 and $49 a month or $9.50 and $24.50 billed annually, with request_human_decision capped at ten a month on free. Catalogued against Taskade and Taskfolk, which are far broader, for the one thing neither carries: a promise clock with lease-based claiming. |
| Buzzmark MCP | Marketing / Content Operations | A ghostwriter that reads the operator's website before it writes, keeps the founder's voice separate from the company's, returns one version per network for Instagram, LinkedIn, Facebook, X, Threads and TikTok, scores each draft for how much it sounds like the brand, and checks it against writing rules before the operator sees it. Twenty-one tools across social sets and brand profiles, the writer, create_image, create_weekly_content_plan, save_draft, save_as_drafts, schedule_post, schedule_posts and get_post; nothing goes out on the spot, because a scheduled post lands on the Buzzmark calendar where it can still be changed. Probed live from the mcp.so feed card it arrived on: POST https://buzzmark.ai/mcp returned HTTP 401 invalid_token, so the endpoint is hosted and OAuth-gated, and no account was created, which is why the surface is documented rather than driven. Registry ai.buzzmark/mcp 1.0.0. Priced per brand, per channel and per writing volume at $29, $49 and $99 a month, with the first twelve months of the two higher tiers at $36.75 and $74.25 and a trial that charges nothing today. Catalogued against the dense publishing class it enters, because the question it answers is different: not whether the post can be sent, but whether it sounds like the business. |
| HotelVALORA MCP | Finance / Real Estate | Institutional hotel valuation as nine read-only tools: search_assets and get_asset, get_report for the sealed analysis with the value opinion, NOI and cap rate, €/key and €/m², a five-year USALI P&L and levered underwriting with IRR and MOIC, get_compset, get_market for ADR, occupancy and RevPAR by submarket, adjust_scenario and goal_seek for CAPEX what-ifs and target-IRR pricing, export_report, and list_own_usage. Probed live: unauthenticated initialize returned HTTP 401 invalid_token; /.well-known/oauth-protected-resource/api/mcp returned 200 with the resource, the same-host authorization server, bearer-in-header and read and write scopes; /.well-known/oauth-authorization-server returned 200 naming /mcp/authorize, /api/mcp/oauth/token, /api/mcp/oauth/register and /api/mcp/oauth/revoke with authorization code, refresh, and S256 PKCE; POST to the non-www host returned HTTP 307 to www, which is the redirect the vendor warns drops the authorization header. Registry com.hotelvalora/mcp 1.0.0 active, August 2026. Quota is measured in distinct assets analysed rather than calls, MCP access is included from the Premium tier, and every full analysis is stamped with an HV-… code and a SHA-256 hash of the figures that any reader can check without an account. Coverage is Madrid and New York. Catalogued beside valuation-api-mcp and dfx-real-estate-mcp, neither of which values an operating hotel. |
The three are the same finding from three angles: a work item with a deadline attached, a draft with a score attached, a valuation with a hash attached. Each is a case of the record carrying its own evidence rather than a claim about the record.
Candidates Read and Held¶
Seventy names appeared in neither the catalog nor any sweep report nor the last-sweep ledger, which is the largest genuinely-new cohort since October 24. Sixty-seven were held.
The publisher family of the cycle: cotletdev. Eight self-hosted API-plus-MCP wrappers posted inside the window (Skool, BookingKoala, Fresha, Booksy, Tradify, PeoplePerHour, Milanote and Partiful), all following one pattern: a self-hosted server over the vendor's own REST API, no hosted endpoint to probe, no published tool enumeration, and the operator supplying their own credentials. Held as one ruling rather than eight entries, because the surface is the same wrapper with a different base URL and the maintenance risk is identical. The verticals they cover, salon and trades scheduling especially, are the closest thing to an unserved SMB operations gap seen this month, and they are recorded as the family to revisit if the catalog ever opens a vertical-operations section with real documentation behind it.
The x402 and agent-payments families. B20 Truth, GenesisPay and the ScriptMasterLabs cluster read at one card each and held inside the x402 class per the Bilbop and Plumb rulings. Nidhipati was probed further than most and still held: io.github.mrpkk/nidhipati 0.6.0 is registry-listed, Apache-2.0, and its five tools (verify_receipt, audit_spend, reserve_report, resolve_report, reconcile_books) are read-only over data the caller supplies, with reconcile_books pairing invoices against transfers and refusing to double-count a duplicate payment. It is a real finance surface. It was held because there is no package to drive (the npm name does not exist and pip install nidhipati-proof fails with no matching distribution, leaving an OCI image as the only route), and because the spend-accounting slice is already carried by AgentLedger and the receipts argument is now carried properly by HotelVALORA. Recorded as the one to revisit if a reconciliation section opens.
The saturated classes, held on their existing rulings. GSC Magic (Search Console, Bing Webmaster Tools and GA4 in one) against the SEO class carried by DrUrls, squirrelscan, seomatic and AnotherSEOGuru; PingAura and Peak Answer in the AI-visibility class per geolint, LogNorm and Onsomble; Adgensy and Bidhelm against PaidSync, Markifact, Adrails and the uplads hold; Proxy's ad library against the carried openadlibrary-mcp; VivaDialog against the inbox class carried by Ficiel, Mailroom, Kaption and Bumblebox; MeetMyAgent and Addness in the AI-employee class beside Cedric and Bidhelm; Linkbreakers and b59.link as short-link and QR utilities beside the carried domain and link tools; RecordHTML, Dora, yovoice, CleanAudio and AudioHash against the dense media-generation class that held Vadyu, Axiom Lab, Seedance3 and RooYun; Design Check, Transica, Tavero and Designers as AI-content and design linting; oxframe beside Screenrove and Kodza as design assets.
Agent infrastructure, held. innernet, Membral, Lockstep, Weft and Gisoo as memory, context and session tooling beside Aletheia, Varyz, GhostPaw and Vicem; Parley as agent consensus; Elliot as an independent verifier of agent claims, recorded as the strongest idea in the batch that still lacks a business record behind it; ReMCP and The Agent Forge as control and evaluation surfaces; runnerID as browser session infrastructure; Gydmation as n8n workflow automation.
Regional and single-purpose, held per the standing rule. Pravida (Russian statutes), eCourtsIndia (Indian court records), KiedyKoncert, TopAIMuza and GdzieZabawa (three Polish read-only cultural feeds under one publisher shape), Deutsche Feiertage (German holidays and school terms), Vitalityfit, ALLR, Tarotap, Ink Studio, PopCVs, Slabline, Urban Game Theory, Agentic Kingdoms, fone.me, Remite and the burofax letters, HaggleBoard, Investboard, Bellchain, RobinX and the ScriptMasterLabs chain tools. Each answers a real question for somebody; none holds a business system of record an operator's assistant would connect twice.
Two directory behaviour notes rather than candidates. First, page five of /all returned 18,069 bytes of reader output containing zero server links, while pages one to four and six returned thirty cards each; it was excluded rather than treated as 24 missing servers. Second, Vadyu AI Video Ad Studio read as new by every slug test this sweep and was already held on October 24 in the night pass's submission window. The rule that caught it was reading .last-sweep as part of the prior-disposition corpus rather than only the dated sweep reports, because the ledger holds dispositions that no report repeats, and a slug-only comparison reproduces the same entry twice.
Source Behaviour Worth Recording¶
The counter is the signal again, and this time it moved in the right direction. Twelve hours of zero movement across four captures on October 24, then 17,243 to 17,354 between the late sweep and this one. The day before, the lesson was that a flat counter hides churn; today's is its mirror: when the counter moves by a hundred, the listing body has been rewritten, not appended, so pages one to six carry a cohort no earlier pass saw even though the URLs are old.
The feed and the listing moved independently. mcp.so's page one served thirty cards with the newest at two hours old, and only one of them, Buzzmark, was absent from every prior record; the other nine posted since the last capture were OdileM2M, Leviathan, AwardTape, cp0x, CardNexus, Pugi, Convertlyft and Candor Finance, all held on October 24, plus watchcron-mcp and guarddog-mcp which were read then too. A feed that repeats itself for a day is a feed that has been fully read.
One housekeeping correction: the counter phrase carried in earlier entries undercounts the guide body. Measured on disk at this pass, servers/external holds 984 server directories and 1,132 markdown files; after this pass 987 and 1,135. The sweep line below uses the measured numbers.
Catalog 984 to 987 server directories (+1,132 to +1,135 guide files). Sources: mcpservers.org /all pages 1, 2, 3, 4 and 6 via r.jina.ai (150 cards, 150 unique server pages against a directory up from 17,243 to 17,354, reader stamp Sun 25 Oct 2026 04:01:42 GMT), mcp.so /feed page 1 with a browser user agent (30 cards, newest buzzmark at two hours before the capture), the official MCP registry search API for four names, the npm registry and the shipped qodflow-mcp 0.1.3 bundle read locally, the vendor documentation and pricing pages for QodFlow, Buzzmark and HotelVALORA, and live HTTP probes: JSON-RPC initialize on https://buzzmark.ai/mcp and https://www.hotelvalora.com/api/mcp, RFC 9728 discovery and authorization-server metadata on HotelVALORA, and authenticated-endpoint probes on https://www.qodflow.com/api/jobs.