MCP Server Discovery - October 30, 2026 (Night Sweep)¶
This pass fired at 21:00 MST, ten hours after the late-morning read. Both directory surfaces changed behaviour rather than just content: mcpservers.org stopped answering direct curl entirely, returning a Cloudflare interstitial on a Linux and on a macOS user agent, so the /all newest page was read through the r.jina.ai proxy instead (30 slugs, counter 18,400), while the mcp.so homepage recentServers block grew from 16 blocks on this machine's morning read to 65 cards with the newest at 2026-10-30T22:19:40Z.
Every slug was cross-referenced against all 1,450 files in the guide tree plus the sweep reports and the previous ledger, and every survivor was then grepped in space form before it was treated as new. That second step is what separates a real find from a slug with a hash suffix: relaticle-076b19 and surgemesh-de3cd3 read as unregistered names against a directory list and as prior dispositions against the prose record.
Two entries were catalogued.
What Was Catalogued¶
Spark Inventory MCP sits at https://api.sparkinventory.com/mcp and answered a keyless tools/list with HTTP 401 Unauthorized in 0.4 seconds. The card was filed the same day at 22:19:40Z, verified and featured, transport Streamable HTTP, authType oauth, category Productivity, and no repository because the service is closed. The audience is named precisely, product brands, wholesalers and 3PLs, and the described surface runs in four directions: stock and risk by SKU, location and warehouse with days of supply and stockout risk; Demand ESP forecasts; reorder recommendations sized to lead time and MOQ with draft purchase orders; and operations reads and writes across sales orders, suppliers, transfers, receiving, pick lists and reports.
Two sentences in the description carry the design, and they are why this is a new slice rather than the catalogue's eleventh storefront opinion. The forecasting model is picked per SKU by backtest, which is an admission that one model fits neither a fast-moving consumable nor a slow-moving spare part and that the choice is testable. The history is corrected for stockouts, which is the part most implementations skip: a SKU that sold out in week three records low sales for the rest of the month, an uncorrected model reads that hole as falling demand, forecasts less, reorders less, and the next stockout is caused by the tool that was supposed to prevent it. A confidence level attached to each forecast is also the difference between a number and an answer.
The containment is on the card in the right words, governed writes that you review and approve and purchase orders drafted rather than issued. That keeps the irreversible step in human hands while leaving the expensive part to the agent, which is the join across four records an operator keeps in four places: current stock, open purchase orders, supplier lead times and the forecast. The vendor also states that Spark Inventory is an official app inside ChatGPT and that a Claude connector is coming soon, so today Claude reaches it as a custom connector rather than in one click. Gap recorded: tools/list needs a token, so the tool names, count and write surface are the vendor's published position and not a list this pass measured, and a trial should settle whether forecast confidence returns as a quotable field, whether a draft PO can land in an existing ERP, and what the connectors actually cover for Shopify or a 3PL.
offprompt MCP is a local stdio package, offprompt 0.3.0 on npm, MIT, Node 22 or later, with zero runtime dependencies and a single bin entry, which for a tool whose whole job is handling secrets is the cheapest supply-chain check available and a real one. npx offprompt init runs in a project, detects the agents there and registers the server. When an agent needs a credential it calls collect_secret, a page opens on 127.0.0.1, a person types the value, and it is written straight into .env.local or a named file; the agent receives the key's name and a fingerprint and never the value. await_secret covers the case where the agent must wait for the human step rather than race past it, and cancel_secret is the abort path a two-tool design usually forgets.
65 provider formats are validated as the value is typed. The timing is what matters: a wrong key caught at the page costs one retype, the same key written to a env file costs a 401 an hour later at the point where the agent is mid-task and reporting the wrong cause. The fingerprint is the decision worth copying, because a tool that returns only "ok" leaves the agent unable to tell a key it just collected from one already in the file, which is exactly how a production key ends up in a staging test. The distinction from the catalogue's Vaultwarden MCP is intake versus retrieval. The trade to make deliberately is the cloud-sandbox path, where a Cloudflare quick tunnel exposes the page because 127.0.0.1 inside a container is not the developer's laptop, and the property that makes local mode strong, that nothing leaves the machine, does not survive the move. Gap recorded: nothing was installed or executed, the three tool names are the vendor's publication, and whether the file write accepts any path the agent names, whether await_secret blocks or polls, and whether the tunnel is scoped to a single collection are each one install away from an answer.
Read and Held¶
relaticle-076b19 is the substantive hold, and it is a hold on class rather than on quality. It is an AGPL-3.0 open-source CRM with a hosted endpoint at mcp.relaticle.com answering HTTP 401 {"message":"Unauthenticated."}, OAuth 2.1 with dynamic client registration and PKCE, a personal access token path, self-hosting by Docker with an /mcp endpoint, role parity with the web app, writes that save directly, emails held a few minutes before they send, and a 14-day trial with no card. The repository github.com/relaticle/relaticle and the developer docs both answer HTTP 200. It is held because the open-source CRM slice was opened four days ago by Customermates, which carries per-workspace URLs and a 40-tool surface on an AGPL core, and a third CRM surface adds no question the first two did not.
The rest of the window was already dispositioned, and each name is recorded so the next pass cannot read it as fresh. current answers 401 Sign in to Current to use this connector. and carries a double hold beside the CRM readers. Margo, Luria, Pylot AI, GlobalCast, Zsign, DiffMint, Breakwire, SniffPup, Wiro, FFxF, Onemira, MakeViral, Gadriel, Fotor and roTEAMnet were named in the previous night's /all window and are unchanged, with Margo priced research and Luria split testing both readable in full and both still on the marketing class hold. ghostedit, werify-app and nextesy-mcp carry holds from the same pass. artil stays unverified because https://mcp.artil.ai answered 404. infranest, influencico and trollwall sit on the monitoring, creator-discovery and moderation classes. whiteboard-animation and paddock-cards were dispositioned earlier in October. ball-ranks-fantasy-sports is consumer entertainment rather than an operator surface.
pixellab-mcp and blockbench-mcp-plugin are not arrivals at all: both appear in the mcp.so "top servers" footer on every page read this pass, and both sit in the media and design generation class this catalogue already carries heavily. The four personal-slug records on the mcpservers.org newest page, jangtrinh, kenil9630, richard-ewing and uncoalesced, carry no card content to evaluate and nothing is claimed about them.
Count¶
The mcpservers.org counter reads 18,400 and the newest page yielded 30 unique slugs through the reader proxy, which is the full page rather than a subset. The mcp.so homepage recentServers block returned 65 cards on this read against 16 blocks on the morning read from this machine, so block count is not a measure of arrivals and the createdAt stamps are. The guide tree held 1,065 server entries before this pass and holds 1,067 after it. Sources: the mcp.so homepage recentServers block read directly, mcpservers.org /all through the r.jina.ai reader proxy after direct curl was refused by Cloudflare on two user agents, detail reads on four candidate slugs and four mcpservers.org detail pages, one keyless JSON-RPC probe on https://api.sparkinventory.com/mcp (401) and registry and repository checks on offprompt at npm 0.3.0, github.com/offprompt/offprompt and offprompt.dev (both 200).