MCP Server Discovery - October 28, 2026 (Midday Sweep)

Seven hours after the morning pass, the mcpservers.org counter read 17,913 again, unchanged for the second consecutive window and the third consecutive read going back to 02:04 GMT. The composition underneath it moved hard: thirty slugs left pages one to three and thirty new ones arrived, which is a full page turnover with no net addition to the index. That combination is worth naming because it inverts the usual read of that surface. A stable counter with a churning page means the directory is re-ranking and re-slugging what it already holds, not ingesting, and the thirty new slugs resolved to guide pages, card endpoints, documentation routes and regional oddities rather than to new servers. Breadth cost three fetches and returned no catalogue entry.

The delta came from the two surfaces that did move. The feed's newest card was stamped 2026-10-28T15:39:45Z, five and a half hours past the morning's newest, and the submission window advanced from #6286 to #6322, thirty-six issues in seven hours. Of those, three were documentation maintenance rather than submissions (#6289, #6290, #6292), which leaves thirty-three substantive claims to read.

What Was Catalogued

Six entries earned guides. Every endpoint in this batch was probed rather than trusted, and one probe contradicted its own directory card.

HighLevel Agency MCP is the entry this cycle exists for, and it is a correction. The mcpservers.org card advertises 481 tools across 39 domain families. https://ghlagencymcp.com/mcp answered a bare initialize with HTTP 200 keyless, serverInfo name highlevel-agency-mcp, version 1.0.0, on protocol 2025-06-18, and tools/list returned thirteen tools. The thirteen are not a subset of an API proxy, they are a differently shaped product: ghl_snapshot_diff_audit compares a live client sub-account against a reference Master Snapshot without overwriting assets, ghl_custom_values_audit reads Custom Values and SMS/email templates for broken merge tags, ghl_phone_wallet_audit reads LC Phone numbers, number pools, forwarding loops and unassigned monthly wallet drain, ghl_user_role_governance audits staff permissions against least-privilege presets for va-support, sales-rep, client-admin and agency-admin, and ghl_domain_ssl_onboard plans, verifies and attaches custom funnel domains with SSL checks. The control that makes the writes safe is ghl_agency_tools_enable, which sets a Safe-Writes Policy preset of read-only, dry-run-first or standard for the session. A catalogue that repeated the card's number would have been wrong about this server for months; the entry records the measured count and says why.

Requstory MCP is the only fully drivable surface of the window and the most operator-shaped find. https://requstory.com/mcp returned HTTP 200 on a bare initialize, serverInfo requstory 1.0.0 on protocol 2025-06-18, and tools/list returned ten tools. Three need no key at all: search_companies, get_company_score and check_ai_readiness. The score is out of 100 across four parts, find and understand, get started online, get help, and AI-agent readiness. map_website takes up to six pages of a public site and returns the customer journey, the teams with their owners, the processes and the handoffs between them, and then names the teams with no owner plus the checks peers pass and this company fails, which is the difference between a summary and a finding. get_ai_company builds a made-up company run end to end by agents from real public maps, teams as agent lanes, which is the clearest explanation of agent-native operations this catalogue has carried.

ISMS Copilot MCP takes the compliance half of an ISMS and hands it to an agent inside the customer's own workspaces. https://account.ismscopilot.com/v1/account/mcp answered initialize with HTTP 401 and {"error":{"code":"UNAUTHORIZED","message":"Authentication failed. Please log in again."}}, the correct account-gated shape, so the surface is the vendor documentation and the registry entry io.github.tristanroth1/ismscopilot-account. Framework interpretation, policy drafting, control mapping, gap analysis, risk registers and audit preparation across ISO 27001, SOC 2, GDPR, NIS 2 and DORA. It is catalogued with its boundary stated: this is the framework and document layer, and it does not read cloud configuration to prove a control operated. Nizh serves frameworks to agents with posture checks and hash-chained attestations, Fallax turns phishing simulation results into ISO 27001 A.6.3 evidence, and Auditspark covers audit workflow, so the split is that the ISMS of record lives here and the technical evidence still comes from the systems.

User Intuition Research MCP is the first qualitative research surface in this catalogue that recruits. https://mcp.userintuition.ai/mcp answered initialize with HTTP 401 and {"error":"invalid_token","error_description":"Missing Authorization header"}. The design decision that earns the entry is ordering: the agent plans the study first, from a brief, before anything is recruited, so the research design is reviewable rather than implied. Then it recruits from a vetted panel of over four million consumers or from your own users, and runs AI-moderated voice, chat or video interviews of twenty to thirty minutes in more than eighty languages. Registry ai.userintuition/research. The limit is recorded honestly: a consumer panel answers a consumer question and answers a B2B question badly, and consistent AI moderation is a strength for comparability and a weakness when the conversation needs someone to break the script.

Mobzio MCP closes an attribution hole the Amazon-centric tooling ignores. https://app.mobz.io/mcp answered HTTP 401, and the neighbouring /api/mcp answered 403, so the documented route is the real one. Deeplinks for Wildberries, Ozon, Yandex Market and Kaspi with daily click statistics per link, orders attributed to each link with amounts, a daily account overview, link diagnosis and link creation. Eight read tools and one write tool, and nothing can be deleted, which is the right default for an attribution ledger. Tool descriptions are in English and the returned data is in Russian. The limit is that attribution is link-level, not person-level.

Pandus MCP covers the accessibility obligation that the European Accessibility Act has now put on consumer commerce. https://pandus.online/mcp answered HTTP 200 with three tools keyless (search_rules, explain_rule, explain_wcag_criterion), and the vendor documents ten with seven behind sign-in or a token, plus two prompts. The part that matters for an operator is not the finding but the fix: each rule card carries what is wrong, who is affected, and how to fix it in code and on Shopify, WooCommerce, PrestaShop and Shoptet, so the agent can go to the template that renders the problem. compare_checks separates what was fixed, what is new and what is still open between the two latest checks. The vendor states the boundary in its own words, automated check, not a full audit, not legal advice, and the entry repeats it rather than softening it.

What Was Held

Also identified (not catalogued): the two ASO entries in the feed and the /all page, AsoBeast (#6312, 44 read tools plus 7 opt-in write tools on keyword rankings to position 200, competitors, listing changes, reviews, top charts and audits) and Storelift (#6321, App Store and Google Play keyword rank tracking at https://storelift.net/mcp), plus AppGoat on /all (App Store and Google Play data, keywords, rankings, top charts and competitors) and Apparent (app.apparent.fyi/mcp, answering 401), are all held on class because Sonar ASO MCP and AppSigma App Store Data MCP already carry app-store keyword, ranking and review data. Rillow (#6311, SEO data, content plan and daily Google rank tracking) is held on SEO saturation, which three morning entries already deepened: dotTide, SEO Audit Console and AEO Engine. Bobos Dispatcher (#6310, white-label AI console for agencies and MSPs with per-client workspaces, roles, approvals and a spend ledger) is held on the MCP gateway and governance class already carried by Agent Warden and the miniOrange gateway. HalloFelix von InsurMagic (#6298, answering HTTP 401 naming OAuth or a bearer token) is a vertical AI phone and WhatsApp assistant for insurance brokers in Germany, Austria and Switzerland, held on the vertical assistant class alongside Conciergr. JobsPipe (#6313, live postings from 30+ boards and ATS feeds) is held because Hilead carries hiring signals. The three CleanData-Labs Apify actors in the window (#6317 Google Trends Explorer, #6318 URL to Markdown, #6319 Google Ads Transparency Explorer) are held on the Apify-actor distribution class set by the Metqo Data ruling, even though the ads-transparency actor is business-relevant. Breakwire (#6316) was driven to HTTP 200 keyless with 16 tools and its breaking-change registry is genuinely well built, but it is developer tooling and the window carried five more of that class: DepTime (#6320), Optiq (#6322), Fanout (#6306), Systra Tools (#6305) and agents-learning (#6315). Climate Insights Directory (#6314, keyless policy research index), Living Projects (#6304), publish.my (#6303), Ainovaq (#6300), Vibe Shipped (#6299), VectoSolve (#6297), t3-watch (#6296), Agent.chain.tokyo (#6295, Japan mailing address at 55 USDC per location per 30 days over x402), Screenrove (#6294), Blazing Video (#6293, macOS only), Conciergr (#6291), DrinkedIn Night Out (#6288) and VibeMind (#6309) are held on class or on shape. Requstory, the one keyless surface, was driven end to end; Breakwire was driven and held, so no candidate this window was dispositioned on an unprobed claim.

Surfaces At This Gap

• mcpservers.org /all pages 1 to 3, read through the r.jina.ai reader proxy: 84 unique slugs, counter 17,913 against 17,913 at the 10:05 GMT read, the second consecutive zero-move counter, with 30 slugs arriving and 30 leaving, a full page turnover with no net ingestion.
• mcp.so /feed, direct TanStack fetch with a browser user agent: 30 cards, newest 2026-10-28T15:39:45Z against the morning's newest of about 2026-10-28T09:05Z.
• chatmcp/mcpso issue window #6287 to #6322 over the authenticated GitHub API: 36 issues in seven hours, three of them documentation maintenance, thirty-three substantive.
• Live probes on five endpoints: Requstory 200 keyless with 10 tools, HighLevel Agency 200 keyless with 13 tools, Pandus 200 keyless with 3 tools, ISMS Copilot 401 UNAUTHORIZED, User Intuition 401 invalid_token, Mobzio 401, Apparent 401, HalloFelix 401, Breakwire 200 keyless with 16 tools, Mobzio /api/mcp 403.

FAQ

Why catalogue HighLevel Agency MCP when the card said 481 tools and the endpoint served 13?

Because thirteen measured tools are better evidence than four hundred and eighty-one claimed ones, and the thirteen are a coherent product rather than a slice of one. The card describes an API proxy. The endpoint exposes a curated set of agency operations tools behind a Safe-Writes Policy, and its audits alone, snapshot drift, merge tags, phone wallet drain and staff roles, answer questions an agency actually has. The count discrepancy is recorded in the entry so nobody later "corrects" it back to 481.

Is a stable counter with a churning page a healthy directory?

Not on its own. A counter that does not move while pages one to three turn over completely means the index is re-ranking and re-slugging what it already holds, not ingesting. It also means page-based breadth sweeps return composition noise rather than candidates at short gaps, which is why this window's delta came entirely from the feed and the submission window.

What makes Requstory different from the company-intelligence servers already catalogued?

It reads the process rather than the profile. Most company data servers return firmographics, funding, headcount and tech stack. Requstory returns journey stages, teams with owners, handoffs, the teams with no owner and the checks peers pass that this company fails, then scores whether an agent could actually buy from the site. That is an operations read, and get_ai_company extends it into what the same company looks like run by agent lanes.

Why hold Breakwire after driving it to a full 16-tool list?

Because a well-built server and a catalogue entry are different decisions. Breakwire's breaking-change registry is unusually disciplined, source-linked claims with affected versions, deadlines, verification status and an outcome-report loop, and it was driven keyless to completion. It is also developer tooling, and this window already carried five developer tools. Driving a surface and cataloguing it are separate judgements, and saying which one happened is the point of this section.