MCP Server Discovery - October 26, 2026 (Morning Sweep)¶
The listing that had been frozen through the whole of Sunday came back with a moderation batch. mcpservers.org served 17,522 servers at the 10:0xZ captures against 17,360 at the 23:26Z read nine hours earlier, and the counter did not hold still inside a single pass: page three answered 17,521 and page four answered 17,354, which is a batch being applied while it was being read rather than three different directories. Eight pages were read, 240 cards, and every card that resolved to a name already in this catalog matched on the name rather than the slug, because the registry derives its URLs from domains and this catalog names products.
Three entries earned a guide, and each needed a different proof: one answered without a key and was driven four times against our own domain, one published its capability in discovery documents because its tools sit behind a paywall, and one published a discovery document that sits a layer away from the URL its own authentication header points at.
New Servers Catalogued¶
| Server | Category | What it does |
|---|---|---|
| CitedBy MCP | Marketing / AI Visibility | Four free read-only tools on https://citedby.eu/mcp, driven end to end in this sweep without a key. initialize answered HTTP 200 as citedby 1.0.0 on protocol 2025-06-18 and tools/list returned four tools in 2.9 KB of schema: check_page, which fetches one page as CitedBot with robots.txt respected and returns a score with per-finding severity, reason and fix; check_ai_crawler_access for GPTBot, OAI-SearchBot, ChatGPT-User, PerplexityBot, ClaudeBot, Google-Extended, Bingbot and Googlebot; check_llms_txt, which checks existence, link resolution and the /llms-full.txt companion; and backlinks from the Common Crawl domain web graph. All four were executed against corpusiq.io: crawler access returned 8 of 8 can read the site dated 2026-10-26 with each bot labelled by what it does; check_llms_txt returned present true, 11,256 bytes, 10 links checked, 0 broken and /llms-full.txt at 200; check_page returned score 90/100 with two findings, schema_rejected on a SoftwareApplication block missing offers.price or one of aggregateRating or review, and render_blocking at 0 scripts and 7 stylesheets; and backlinks returned in_data: false with the coverage window stated instead of a zero, 264,847 domains holding 100 or more referring domains under .eu, EU and UK country domains plus the most-linked sites, from cc-main-2026-aug-sep-oct read 2026-10-23. Catalogued because a blocked crawler is total invisibility that no ranking report shows, and because this is the first checker on this beat that refuses to score what it could not read. |
| Adspy MCP | Marketing / Advertising Intelligence | Competitor ad research at https://www.adspy.sh/mcp, gated on initialize with HTTP 401 {"error":"Connect an authorized Adspy account.","code":"invalid_token"}, so the capability is read from the server's own documents. The RFC 9728 protected resource returns resource: https://www.adspy.sh/mcp, one authorization server, header bearer tokens and five scopes, read, write, discovery, export and usage, with resource_name: Adspy creative research; the authorization server metadata names authorize, token, revoke and register endpoints, response_types_supported: ["code"], authorization code and refresh grants, PKCE S256, token_endpoint_auth_methods_supported: ["none"] and client_id_metadata_document_supported: true, which is the public-client pattern with no manual app registration. Per the vendor listing the library holds over two million creatives from 2,000+ advertisers across Meta and Google with organic TikTok, YouTube and Instagram posts on the paid tiers, and each result returns the hook, angle, format, call to action and a transcript, with collections and notes for a team. Plans are $19 Starter on one source with 2,000 credits, $39 Pro on every source with 6,000, $99 Unlimited with no credit count, and Enterprise adding a REST API, with the credit conversion published as roughly 22, 66 or unlimited Brand Full Analyses a month. Catalogued because it reads public advertising rather than an ad account, so a business with no relationship to a competitor still gets the material, and because nothing else here covers creative research as distinct from campaign execution. Limitations recorded: no spend and no ROAS, no ad account connection, no free tier, and the tool schemas were not read. |
| GBPly MCP | Marketing / Local Business | Google Business Profile over https://mcp.gbply.net/v1, gated on initialize and tools/list with HTTP 401 {"error":"unauthorized"}. The WWW-Authenticate header points at https://mcp.gbply.net/functions/v1/mcp/.well-known/oauth-protected-resource, which answers {"error":"not_found","use":"https://mcp.gbply.net/v1"}; the live document at /.well-known/oauth-protected-resource returns resource: https://mcp.gbply.net/v1, an authorization server at https://mcp.gbply.net/oauth, header bearer tokens and no scopes_supported field at all, and that server's own metadata returns scopes_supported: ["email","profile","offline_access"] with PKCE S256 and response_types_supported: ["code"]. Identity scopes only, no reviews:write and no posts:write, which is the finding: authorization over business data lives in the product's request system rather than in the token, the opposite of the eight resource scopes Leadpages publishes. Capability from the vendor connector documentation: read on workspaces, profiles, completeness, insights that run 2-3 days behind, monthly search terms, reviews and rating stats, posts, photos, Q&A, Profile Guard changes, Rank Tracker and citation scans, analysis reports and credit balances; draft with nothing saved for AI review replies, Q&A suggestions and rank-scan cost previews; a request for every publish, schedule, edit or delete of a reply or post, every saved FAQ, every profile field, every Profile Guard decision and every paid scan; and direct only for a Google sync a few times an hour. Requests expire in fifteen minutes and run once, and on approval the vendor re-checks permission, credits, plan limits and the daily post cap. An optional per-action Always allow covers publish, profile change, spend credits with a most-per-request and a most-per-24-hours limit, and deletes of things not yet live, scoped to one assistant in one workspace, overridable by the workspace owner and only switchable from a 2FA sign-in inside a 2FA workspace. Catalogued because the write side of the profile is where local businesses lose, and because the approval contract here is the cleanest example in this catalog of an agent that can prepare everything and commit almost nothing. |
Candidates Read and Held¶
The submission window, #6132 to #6154, twenty-three issues with no gaps. GTM Daily (#6137) searches verified open go-to-market and RevOps jobs and matches them to a profile over OAuth with PKCE, held in the jobs class carried by Applystead and the ATS hiring entries. FundingTracker (#6134) is public read-only funding data with no authentication, held beside the funding and market-data entries. Emero (#6154) is a media generation studio with a second brain over 6,000 tested generations, held inside the media generation class that holds PromptWise, Axiom Lab and Shootika. Oleafly (#6144) serves a bearer-token MCP from a desktop app on 127.0.0.1, held as desktop tooling. make.ad (#6139) and Revana (#6138) are two products from one publisher, held on the ad-execution and media classes. Leave Hacker (#6141) works out which days of annual leave to take, ScribeToAny (#6140) transcribes audio, Taskbead (#6136) is another to-do list, Hookpost (#6135) is webhook plumbing, AgentRead (#6132) converts pages and documents to Markdown with a prompt-injection scan and is developer infrastructure beside Elliot and Kerno, and Email Validation (#6133) sits in the email verification class this catalog already carries. Retirement Atlas (#6147), Swatch Ledger (#6148) and Name Generators (#6146) are three from one publisher, consumer calculators held once as a family. Japanese Skills (#6150) is language learning, FLOGVIT.bible (#6153) is scripture search, Eleições 2026 (#6149) is Brazilian electoral court data, Glucoray (#6143) is consumer health, GrooveSheet (#6145) is sheet music, busik.ch (#6142) is Ukrainian-Swiss minibus travel, GhostPaw Grimoire (#6151) is local developer tooling and BibiGPT (#6152) is video summarization in the media class.
On the feed, the newest cards. Adspy.sh was twelve minutes old at the read and is catalogued. AOCI-CODE at forty-nine minutes keeps a Git-versioned, model-written index of a codebase and its database schema so a coding agent starts each task with the whole system in view, held as developer infrastructure beside Vicem and Distill. Everything below those had been dispositioned in the late sweep nine hours earlier: Blaze, Leadpages MCP, PromptWise, how.is, xhostd, More AI Fortnox, next-generation-movers, agent-media, Buzzmark, OdileM2M, Leviathan Systems, AwardTape, cp0x, CardNexus, Pugi, Convertlyft, Candor Finance, watchcron-mcp, guarddog-mcp, Tradetron, Total CMS, AppGoat, aicut, Vid Kraken, 3Dsellers, ClosedLoop AI and the LinkedIn DM reader.
On the listing, the business-relevant names that were read and held rather than opened. Meridary for Agents models US retirement year by year with paid analyses behind an Agent subscription, held in the planning class. Acrium runs Google Ads, social, Shopify and inventory with ad spend waiting for owner approval, held because that pattern is now carried twice over by More AI Fortnox and by GBPly catalogued this pass, and because the product is a paid SMB automation platform rather than a data source. Superbridger, Ghostedit, ReelGenie, Postey, FeedSquad, PinBridge, SuperPost and Postkey are eight variants of scheduling and publishing, held as a class this catalog carries heavily and as a class where the assistant is not the differentiator. Ellora checks drafts against a voice profile and names the AI tells, held inside the content-quality class. Ledgo CRM reads and writes CRM records, held beside the CRM class carried by Context4 and the connector entries, because a second CRM reader adds no new question. OpenGMB is the open-core, self-hosted version of this pass's GBPly finding, with tokens that are read-only or read-write, geo-grid rank tracking on the operator's own DataForSEO account, and Google API approval required for the operator's own project; recorded inside the GBPly guide as the self-host alternative rather than opened separately on setup cost. Timero tracks agency time, MYSTIQUE measures ATS hiring velocity, doola forms US LLCs, Investboard checks investment strategy, LexAtlas serves statutes for CIS countries, npiwho looks up US health care providers and MCPSkillHub is a directory of 49,000 servers; all held in classes already carried here. The nine textforagents products are pay-per-check agent infrastructure, held once as a publisher family.
Directory Behaviour¶
The counter moved for the first time since Saturday, 17,360 to 17,522 on the page one read, then read 17,521 and 17,354 on later pages inside the same pass. That is not three directories: it is one directory applying a moderation batch while the pages were fetched, so a count taken from a single page is a snapshot of a moving number. The pages were read through the reader proxy because the direct fetch returns 403 to this client on every attempt.
Listing Re-Verification¶
Not repeated this pass. The midday sweep verified our own five surfaces yesterday and none of them changes inside a day; what was checked here is the one surface that does move, the crawler and citation surface, and it came back healthy: 8 of 8 AI crawlers allowed, llms.txt live at 11,256 bytes with 10 of 10 links resolving, llms-full.txt at 200, and a page score of 90/100 whose only warning is a SoftwareApplication block Google rejects. That last item is a defect on a served page rather than a matter of taste, and it is recorded here instead of being smoothed over.
Catalog 992 to 995 servers (+1,140 to +1,143 guides). Sources: mcpservers.org /all pages 1 to 8 via the r.jina.ai reader proxy at the 10:0xZ captures, 240 cards against 17,360 nine hours earlier with 17,522 rising and 17,521 and 17,354 seen mid-pass; mcp.so /feed page 1 through the same proxy, newest card Adspy.sh at twelve minutes and AOCI-CODE at forty-nine; the chatmcp/mcpso issue window #6132 to #6154 over the authenticated GitHub API, 23 issues with no gaps and the last pass having ended at #6131; detail pages for every catalogued and held card; and live JSON-RPC sessions: initialize, tools/list and four executed tools/call requests on citedby.eu, and initialize plus tools/list returning 401 on both gated endpoints, with the RFC 9728 protected resource and authorization server documents read on each gated host.